NETSCALER ADC / GATEWAY 14.1 · CVE-2026-120860 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293 ✓ verified
A memory overflow in how NetScaler ADC and NetScaler Gateway handle load-balanced Diameter, SIP-over-TCP, MQTT and RADIUS traffic can cause erratic behavior or a denial of service. The sources describe the impact as unpredictable behavior or denial of service rather than code execution.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC (and Gateway builds on the same releases) is exposed only if it has a load balancing virtual server of type DIAMETER, SIP_TCP, MQTT or RADIUS. Traffic to that vserver can trigger a memory overflow that Citrix says may cause erroneous behavior or denial of service; Citrix rates it CVSS v4 8.7 with no authentication needed. Appliances without such vservers can skip it.
Not affected if managed-hosting, no-diameter-sip_tcp-mqtt-radius-lb-vserver, no-netscaler, protocol-lb-not-used
Who cares citrix, diameter, load-balancing, mqtt, netscaler, radius, self-hosted, sip
Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
add lb vserver <name> DIAMETER|SIP_TCP|MQTT|RADIUS <IP> <Port> (e.g. 'show running config | grep -E "add lb vserver .* (DIAMETER|SIP_TCP|MQTT|RADIUS) "')show version with the fixed buildsUpgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.