NETSCALER ADC · CVE-2026-120863 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 +2 ✓ verified
A memory overflow in the management plane of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior or a denial of service. The sources do not say whether code execution or data access is possible.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-managed NetScaler ADC and NetScaler Gateway appliances running a build older than the fixed ones. Citrix's precondition is that an attacker on an untrusted host can reach the NSIP or NSIP6 address, so appliances whose management IP is reachable only from a trusted admin network have much less exposure. No authentication is required (CVSS v4 PR:N), and the impact is availability (DoS or erratic behavior).
Not affected if citrix-managed-cloud, management-network-isolated
Who cares citrix, load-balancer, management-plane, netscaler, netscaler-gateway, self-hosted
Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 +2
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later of 13.1, ADC 14.1-FIPS 14.1-73.58 or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later