{"id":"CVE-2026-120861","kind":"vulnerability","aliases":["CVE-2026-120861"],"related":[],"title":"Citrix NetScaler ADC/Gateway: memory overflow in GSLB and geolocation can cause denial of service","description":"Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler","summary":"A memory overflow in NetScaler's GSLB and geolocation features (MEP, static-proximity, config-sync) can cause unpredictable or erroneous behavior. The flaw can also be used to cause a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC and Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS and NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix-netscaler","gslb","load-balancing","self-hosted","vendor"],"not_affected_if":["citrix-managed-cloud","no-gslb"],"how_to_check":"Only appliances with GSLB or geolocation configured are in scope. Search the NetScaler config for: 'add gslb site ... -metricExchange ENABLED', 'set gslb parameter -automaticConfigSync ENABLED', 'add gslb vserver <name> <type> -lbmethod STATICPROXIMITY', or a responder policy using CLIENT.IP.SRC.MATCHES_LOCATION(...). If none match, this CVE's precondition is not met. Then compare the build to the fixed versions.","fix":"Upgrade to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1), 14.1-73.58 FIPS or later (14.1-FIPS), 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). Citrix lists no workaround.","status":"open","published_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:16+00:00","updated_at":"2026-11-13T08:46:13+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-13T08:45:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler: memory overflow in GSLB geolocation can crash or misbehave","impact":"medium","summary":"A memory overflow in NetScaler's GSLB and geolocation features (MEP, static-proximity, config-sync) can cause unpredictable or erroneous behavior. The flaw can also be used to cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["citrix-netscaler","gslb","load-balancing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Check the Citrix security bulletin for CVE-2026-120861 for affected and fixed NetScaler versions and whether GSLB must be enabled.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"NetScaler appliances that run GSLB or geolocation features such as MEP, static-proximity or config-sync are the ones described. The sources do not say which versions or configurations are affected, so whether a given deployment is exposed is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000687,"input_tokens":4528,"output_tokens":468,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Citrix security bulletin for CVE-2026-120861 for affected and fixed NetScaler versions and whether GSLB must be enabled.","search":"'-120861':17A,20A '-2026':16A,19A '13.1':30A,37A '14.1':25A,33A 'adc':22A,27A,32A,36A 'adc/gateway':3A 'also':78B 'and':23A,28A,39A 'balanc':47B 'behavior':74B,108C 'caus':11A,70B,82B 'citrix':1A,42B,114C 'citrix-netscal':41B 'config':67B,100C 'config-sync':66B,99C 'cve':15A,18A 'denial':12A,84B,110C 'erron':73B,107C 'featur':61B 'fips':34A,38A 'flaw':76B 'gateway':24A,29A 'geoloc':9A,60B,94C 'gslb':7A,44B,58B,92C 'handl':90C 'host':50B 'improp':89C 'lead':103C 'load':46B 'load-balanc':45B 'memori':4A,53B,87C 'mep':62B,95C 'ndcpp':40A 'netscal':2A,43B,56B,115C 'netscaler':21A,26A,31A,35A 'overflow':5A,54B,88C 'proxim':65B,98C 'self':49B 'self-host':48B 'servic':14A,86B,112C 'static':64B,97C 'static-proxim':63B,96C 'sync':68B,101C 'unpredict':71B,105C 'use':80B 'vendor':51B","nicknames":[],"mitigations":[],"who_affected":"Customer-managed NetScaler ADC and Gateway appliances (including those used for Secure Private Access Hybrid) that have a GSLB site with MEP enabled, GSLB static proximity, a geolocation responder policy, or GSLB automatic config sync. Appliances without these features, and Citrix-managed cloud services (which Cloud Software Group updates), can skip it. Citrix rates it CVSS 8.7, network reachable with no authentication, and the impact is denial of service.","tier":"B","verified":{"fix":{"at":"2026-11-13T08:46:13Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3836},"products":{"at":"2026-11-13T08:46:13Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3836},"how_to_check":{"at":"2026-11-13T08:46:13Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3836},"who_affected":{"at":"2026-11-13T08:46:13Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3836}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc131fipsandndcpp","adc141fips","adcandgateway131","adcandgateway141","netscaleradc131fipsandndcpp","netscaleradc141fips","netscaleradcandgateway131","netscaleradcandgateway141"],"ptokens":["13","14","adc","and","fips","gateway","ndcpp","netscaler"],"labels":["citrixnetscaler","gslb","high","loadbalancing","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120861':17A,20A '-2026':16A,19A '13.1':30A,37A '14.1':25A,33A 'adc':22A,27A,32A,36A 'adc/gateway':3A 'and':23A,28A,39A 'caus':11A 'citrix':1A 'cve':15A,18A 'denial':12A 'fips':34A,38A 'gateway':24A,29A 'geoloc':9A 'gslb':7A 'memori':4A 'ndcpp':40A 'netscal':2A 'netscaler':21A,26A,31A,35A 'overflow':5A 'servic':14A","search_b":"'also':78B 'balanc':47B 'behavior':74B 'caus':70B,82B 'citrix':42B 'citrix-netscal':41B 'config':67B 'config-sync':66B 'denial':84B 'erron':73B 'featur':61B 'flaw':76B 'geoloc':60B 'gslb':44B,58B 'host':50B 'load':46B 'load-balanc':45B 'memori':53B 'mep':62B 'netscal':43B,56B 'overflow':54B 'proxim':65B 'self':49B 'self-host':48B 'servic':86B 'static':64B 'static-proxim':63B 'sync':68B 'unpredict':71B 'use':80B 'vendor':51B","search_c":"'behavior':108C 'citrix':114C 'config':100C 'config-sync':99C 'denial':110C 'erron':107C 'geoloc':94C 'gslb':92C 'handl':90C 'improp':89C 'lead':103C 'memori':87C 'mep':95C 'netscal':115C 'overflow':88C 'proxim':98C 'servic':112C 'static':97C 'static-proxim':96C 'sync':101C 'unpredict':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120861","severity":null,"published_at":"2026-11-13T08:17:16+00:00","modified_at":"2026-11-13T08:17:16+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120861:3836","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:46:13+00:00","modified_at":"2026-11-13T08:46:13+00:00","first_seen_at":"2026-11-13T08:46:13+00:00","fetched_at":"2026-11-13T08:46:13+00:00","note":"Read Citrix bulletin CTX697305: preconditions, affected/fixed builds, no workaround listed. X/community not searched; no exploitation or PoC stated.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}