CITRIX NETSCALER · CVE-2026-120862 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 ✓ verified
A memory overflow in the SIP ALG (LSN) and DNS answer-section logging code paths of Citrix NetScaler can cause unpredictable or erroneous behavior. The likely outcome for an attacker is a denial of service on the appliance.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC and NetScaler Gateway appliances (self-managed) on 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58, and 13.1-FIPS/NDcPP before 13.1-37.293 are affected, but Citrix says the flaw is only reachable when SIP ALG is enabled on an LSN group or DNS answer-section security logging is enabled in a DNS profile. Appliances with neither feature enabled can skip it. Citrix lists the impact as denial of service or erratic behaviour; CVSS v4 8.7, network-reachable with no authentication.
Not affected if dns-answer-logging-disabled, dns-logging-disabled, sip-alg-disabled
Who cares citrix-netscaler, denial-of-service, network-appliance, self-hosted
show lsn group / the running config) or DNS answer-section security logging is enabled in a DNS profile (-dnsanswerSecLogging ENABLED, including default-dns-profile)Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39
Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1); 14.1-FIPS to 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP to 13.1-37.293 or later.