{"id":"CVE-2026-111342","kind":"vulnerability","aliases":["CVE-2026-111342"],"related":[],"title":"Citrix NetScaler Gateway and AAA servers: LDAP authentication memory overflow can crash the appliance","description":"Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"Citrix bulletin CTX697305 (12 Nov 2026) lists a CWE-120 buffer copy overflow in LDAP authentication that can cause erroneous behavior or denial of service. CVSS v4 8.7, network vector, no privileges or user interaction required in the vector; impact rated availability only. Bulletin does not mention exploitation or a PoC, and says nothing about code execution.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS/NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","denial-of-service","infrastructure","ldap","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["no-gateway-or-aaa-vserver","patched-build"],"how_to_check":"Exposed if the NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server AND runs a build older than the fixed ones. In the running config look for lines matching 'add vpn vserver .*' or 'add authentication vserver .*' (Citrix's own check). Then compare the build (show version) with the fixed builds.","fix":"Upgrade to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1), 14.1-73.58 FIPS or later (14.1-FIPS), or 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). The bulletin lists no workaround.","status":"open","published_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","triaged_at":"2026-11-13T04:43:49+00:00","updated_at":"2026-11-13T04:45:12+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T04:43:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler: LDAP authentication memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in the LDAP authentication code of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state whether code execution or data access is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","ldap"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"appliance crashes or behaves erratically, causing denial of service","analyst_note":"Find the Citrix security bulletin for CVE-2026-111342 to confirm affected versions, fixed builds, required LDAP configuration and whether the flaw is remotely reachable without credentials.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with LDAP authentication configured are in scope. The sources do not say which versions are affected or what configuration is required, so the exposure of any given appliance cannot be determined from them.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4521,"output_tokens":490,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Citrix security bulletin for CVE-2026-111342 to confirm affected versions, fixed builds, required LDAP configuration and whether the flaw is remotely reachable without credentials.","search":"'-111342':17A,20A '-120':62B '-2026':16A,19A '12':56B '13.1':27A,30A,37A '14.1':33A '2026':58B '8.7':80B 'aaa':5A 'adc':22A,26A,32A,36A,129C 'applianc':14A 'authent':8A,68B,114C 'avail':94B 'behavior':73B,121C 'buffer':63B 'bulletin':54B,96B 'caus':71B 'citrix':1A,39B,53B,127C,131C 'code':108B 'copi':64B 'crash':12A 'ctx697305':55B 'cve':15A,18A 'cvss':78B 'cwe':61B 'denial':41B,75B,123C 'denial-of-servic':40B 'erron':72B,120C 'execut':109B 'exploit':100B 'fips':34A 'fips/ndcpp':38A 'gateway':3A,24A,29A,49B,133C 'host':52B 'impact':92B 'infrastructur':44B 'interact':87B 'ldap':7A,45B,67B,113C 'lead':116C 'list':59B 'memori':9A,110C 'mention':99B 'netscal':2A,46B,48B,128C,132C 'netscaler':21A,23A,25A,28A,31A,35A 'netscaler-gateway':47B 'network':81B 'noth':106B 'nov':57B 'overflow':10A,65B,111C 'poc':103B 'privileg':84B 'rate':93B 'requir':88B 'say':105B 'self':51B 'self-host':50B 'server':6A 'servic':43B,77B,125C 'unpredict':118C 'user':86B 'v4':79B 'vector':82B,91B","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC and NetScaler Gateway appliances set up as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, on builds before the fixed ones. Appliances with no vpn or authentication vserver are outside the stated precondition. Citrix's vector lists no privileges required, so treat internet-facing gateways as reachable before login.","tier":"B","verified":{"fix":{"at":"2026-11-13T04:45:12Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3818},"products":{"at":"2026-11-13T04:45:12Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3818},"how_to_check":{"at":"2026-11-13T04:45:12Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3818},"who_affected":{"at":"2026-11-13T04:45:12Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3818}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","adc131","adc131fipsndcpp","adc141fips","gateway","gateway131","netscaleradc","netscaleradc131","netscaleradc131fipsndcpp","netscaleradc141fips","netscalergateway","netscalergateway131"],"ptokens":["13","14","adc","fips","gateway","ndcpp","netscaler"],"labels":["citrix","denialofservice","high","infrastructure","ldap","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-111342':17A,20A '-2026':16A,19A '13.1':27A,30A,37A '14.1':33A 'aaa':5A 'adc':22A,26A,32A,36A 'applianc':14A 'authent':8A 'citrix':1A 'crash':12A 'cve':15A,18A 'fips':34A 'fips/ndcpp':38A 'gateway':3A,24A,29A 'ldap':7A 'memori':9A 'netscal':2A 'netscaler':21A,23A,25A,28A,31A,35A 'overflow':10A 'server':6A","search_b":"'-120':62B '12':56B '2026':58B '8.7':80B 'authent':68B 'avail':94B 'behavior':73B 'buffer':63B 'bulletin':54B,96B 'caus':71B 'citrix':39B,53B 'code':108B 'copi':64B 'ctx697305':55B 'cvss':78B 'cwe':61B 'denial':41B,75B 'denial-of-servic':40B 'erron':72B 'execut':109B 'exploit':100B 'gateway':49B 'host':52B 'impact':92B 'infrastructur':44B 'interact':87B 'ldap':45B,67B 'list':59B 'mention':99B 'netscal':46B,48B 'netscaler-gateway':47B 'network':81B 'noth':106B 'nov':57B 'overflow':65B 'poc':103B 'privileg':84B 'rate':93B 'requir':88B 'say':105B 'self':51B 'self-host':50B 'servic':43B,77B 'user':86B 'v4':79B 'vector':82B,91B","search_c":"'adc':129C 'authent':114C 'behavior':121C 'citrix':127C,131C 'denial':123C 'erron':120C 'gateway':133C 'ldap':113C 'lead':116C 'memori':110C 'netscal':128C,132C 'overflow':111C 'servic':125C 'unpredict':118C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T04:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111342","severity":null,"published_at":"2026-11-13T04:17:36+00:00","modified_at":"2026-11-13T04:17:36+00:00","first_seen_at":"2026-11-13T04:42:39+00:00","fetched_at":"2026-11-13T04:42:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111342:3818","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T04:45:12+00:00","modified_at":"2026-11-13T04:45:12+00:00","first_seen_at":"2026-11-13T04:45:12+00:00","fetched_at":"2026-11-13T04:45:12+00:00","note":"Read Citrix CTX697305 directly: preconditions, affected and fixed builds confirmed. No mitigation or exploitation noted in bulletin; X/community not searched (no evidence of conversation, not checked).","cites":["https://support.citrix.com/external/article/CTX697305","https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}