{"id":"CVE-2026-120860","kind":"vulnerability","aliases":["CVE-2026-120860"],"related":[],"title":"Citrix NetScaler: memory overflow in protocol load balancing causes denial of service","description":"Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in how NetScaler ADC and NetScaler Gateway handle load-balanced Diameter, SIP-over-TCP, MQTT and RADIUS traffic can cause erratic behavior or a denial of service. The sources describe the impact as unpredictable behavior or denial of service rather than code execution.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC / Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC / Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS / 13.1-NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","diameter","infrastructure","load-balancing","mqtt","netscaler","radius","self-hosted","sip"],"not_affected_if":["managed-hosting","no-diameter-sip_tcp-mqtt-radius-lb-vserver","no-netscaler","protocol-lb-not-used"],"how_to_check":"In the ns.conf / running config, look for load balancing vservers of type DIAMETER, SIP_TCP, MQTT or RADIUS: 'add lb vserver <name> DIAMETER|SIP_TCP|MQTT|RADIUS <IP> <Port>' (e.g. 'show running config | grep -E \"add lb vserver .* (DIAMETER|SIP_TCP|MQTT|RADIUS) \"'). If none exist, the precondition is not met. Then compare 'show version' with the fixed builds.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:18+00:00","updated_at":"2026-11-13T08:47:15+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T08:45:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in protocol load balancing causes denial of service","impact":"medium","summary":"A memory overflow in how NetScaler ADC and NetScaler Gateway handle load-balanced Diameter, SIP-over-TCP, MQTT and RADIUS traffic can cause erratic behavior or a denial of service. The sources describe the impact as unpredictable behavior or denial of service rather than code execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","load-balancing","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance behaves erratically or stops serving traffic","analyst_note":"Find the affected and fixed NetScaler versions and the exact protocol configuration needed to trigger the overflow in the Citrix security bulletin; NVD text alone does not give them.","how_to_check":"- Confirm whether your NetScaler ADC or NetScaler Gateway appliance is running a version listed as affected in the NVD entry (unknown from the sources given)\n- Check whether load balancing is configured for Diameter, SIP, MQTT or RADIUS protocols on the appliance (unknown from the sources given)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-netscaler","protocol-lb-not-used"],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway that load balance Diameter, SIP-over-TCP, MQTT or RADIUS traffic are the likely exposure. The sources do not state which versions or configurations are affected, so teams that do not use these appliances or protocols can probably skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000786,"input_tokens":4566,"output_tokens":658,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed NetScaler versions and the exact protocol configuration needed to trigger the overflow in the Citrix security bulletin; NVD text alone does not give them.","search":"'-120860':15A,18A '-2026':14A,17A '13.1':26A,33A,35A '14.1':22A,29A 'adc':20A,24A,28A,32A,56B,128C 'balanc':8A,42B,63B,104C 'behavior':76B,89B,120C 'caus':9A,74B 'citrix':1A,37B,126C,130C 'code':96B 'cve':13A,16A 'denial':10A,79B,91B,122C 'describ':84B 'diamet':38B,64B,107C 'errat':75B 'erron':119C 'execut':97B 'fips':30A,34A 'gateway':21A,25A,59B,132C 'handl':60B,106C 'host':48B 'impact':86B 'infrastructur':39B 'lead':115C 'load':7A,41B,62B,103C 'load-balanc':40B,61B,102C 'memori':3A,51B,98C 'mqtt':43B,69B,112C 'ndcpp':36A 'netscal':2A,44B,55B,58B,127C,131C 'netscaler':19A,23A,27A,31A 'overflow':4A,52B,99C 'protocol':6A,101C 'radius':45B,71B,113C 'rather':94B 'self':47B 'self-host':46B 'servic':12A,81B,93B,124C 'sip':49B,66B,109C 'sip-over-tcp':65B,108C 'sourc':83B 'tcp':68B,111C 'traffic':72B,105C 'unpredict':88B,117C","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC (and Gateway builds on the same releases) is exposed only if it has a load balancing virtual server of type DIAMETER, SIP_TCP, MQTT or RADIUS. Traffic to that vserver can trigger a memory overflow that Citrix says may cause erroneous behavior or denial of service; Citrix rates it CVSS v4 8.7 with no authentication needed. Appliances without such vservers can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:47:15Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3837},"products":{"at":"2026-11-13T08:47:15Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3837},"how_to_check":{"at":"2026-11-13T08:47:15Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3837},"who_affected":{"at":"2026-11-13T08:47:15Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3837}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc131fips131ndcpp","adc141fips","adcgateway131","adcgateway141","netscaleradc131fips131ndcpp","netscaleradc141fips","netscaleradcgateway131","netscaleradcgateway141"],"ptokens":["13","14","adc","fips","gateway","ndcpp","netscaler"],"labels":["citrix","diameter","high","infrastructure","loadbalancing","mqtt","netscaler","radius","selfhosted","sip"],"campaign_type":null,"search_a":"'-120860':15A,18A '-2026':14A,17A '13.1':26A,33A,35A '14.1':22A,29A 'adc':20A,24A,28A,32A 'balanc':8A 'caus':9A 'citrix':1A 'cve':13A,16A 'denial':10A 'fips':30A,34A 'gateway':21A,25A 'load':7A 'memori':3A 'ndcpp':36A 'netscal':2A 'netscaler':19A,23A,27A,31A 'overflow':4A 'protocol':6A 'servic':12A","search_b":"'adc':56B 'balanc':42B,63B 'behavior':76B,89B 'caus':74B 'citrix':37B 'code':96B 'denial':79B,91B 'describ':84B 'diamet':38B,64B 'errat':75B 'execut':97B 'gateway':59B 'handl':60B 'host':48B 'impact':86B 'infrastructur':39B 'load':41B,62B 'load-balanc':40B,61B 'memori':51B 'mqtt':43B,69B 'netscal':44B,55B,58B 'overflow':52B 'radius':45B,71B 'rather':94B 'self':47B 'self-host':46B 'servic':81B,93B 'sip':49B,66B 'sip-over-tcp':65B 'sourc':83B 'tcp':68B 'traffic':72B 'unpredict':88B","search_c":"'adc':128C 'balanc':104C 'behavior':120C 'citrix':126C,130C 'denial':122C 'diamet':107C 'erron':119C 'gateway':132C 'handl':106C 'lead':115C 'load':103C 'load-balanc':102C 'memori':98C 'mqtt':112C 'netscal':127C,131C 'overflow':99C 'protocol':101C 'radius':113C 'servic':124C 'sip':109C 'sip-over-tcp':108C 'tcp':111C 'traffic':105C 'unpredict':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120860","severity":null,"published_at":"2026-11-13T08:17:16+00:00","modified_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120860:3837","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:47:15+00:00","modified_at":"2026-11-13T08:47:15+00:00","first_seen_at":"2026-11-13T08:47:15+00:00","fetched_at":"2026-11-13T08:47:15+00:00","note":"Read Citrix bulletin CTX697305: precondition, affected/fixed builds. No mitigations listed. No exploitation or PoC stated in bulletin; X/posts not searched.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}