{"id":"CVE-2026-120863","kind":"vulnerability","aliases":["CVE-2026-120863"],"related":[],"title":"Citrix NetScaler ADC and Gateway: management plane memory overflow enables denial of service","description":"Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in the management plane of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior or a denial of service. The sources do not say whether code execution or data access is possible.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC","fixed":["14.1-73.57","13.1-64.39","14.1-FIPS 14.1-73.58","13.1-FIPS/13.1-NDcPP 13.1-37.293"],"affected":"unknown (bulletin lists only fixed builds)","ecosystem":"vendor"},{"name":"NetScaler Gateway","fixed":["14.1-73.57","13.1-64.39"],"affected":"unknown (bulletin lists only fixed builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","infrastructure","load-balancer","management-plane","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["citrix-managed-cloud","management-network-isolated"],"how_to_check":"Exposed if an untrusted host can reach the appliance's NSIP or NSIP6 management address. Check the running build (show version) against the fixed builds, and check which networks can reach NSIP. NetScaler Console's Security Advisory dashboard (CVE Detection) can scan for this CVE.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later of 13.1, ADC 14.1-FIPS 14.1-73.58 or later, or ADC 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:12+00:00","updated_at":"2026-11-13T08:46:09+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T08:45:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler ADC and Gateway: management plane memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in the management plane of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable or erroneous behavior or a denial of service. The sources do not say whether code execution or data access is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","load-balancer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves erratically, causing denial of service","analyst_note":"Check the NVD entry and Citrix security bulletin for affected versions, fixed versions, and whether the management interface must be exposed to the network.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway appliances are affected. The sources do not state which versions, configurations or management exposure are required, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4515,"output_tokens":454,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Citrix security bulletin for affected versions, fixed versions, and whether the management interface must be exposed to the network.","search":"'-120863':16A,19A '-2026':15A,18A 'access':74B 'adc':3A,21A,49B,97C 'balanc':28B 'behavior':58B,89C 'caus':54B 'citrix':1A,24B,47B,95C,99C 'code':70B 'cve':14A,17A 'data':73B 'denial':11A,61B,91C 'enabl':10A 'erron':57B,88C 'execut':71B 'gateway':5A,23A,35B,52B,101C 'host':38B 'infrastructur':25B 'lead':84C 'load':27B 'load-balanc':26B 'manag':6A,30B,44B,81C 'management-plan':29B 'memori':8A,40B,77C 'netscal':2A,32B,34B,48B,51B,96C,100C 'netscaler':20A,22A 'netscaler-gateway':33B 'overflow':9A,41B,78C 'plane':7A,31B,45B,82C 'possibl':76B 'say':68B 'self':37B 'self-host':36B 'servic':13A,63B,93C 'sourc':65B 'unpredict':55B,86C 'whether':69B","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler ADC and NetScaler Gateway appliances running a build older than the fixed ones. Citrix's precondition is that an attacker on an untrusted host can reach the NSIP or NSIP6 address, so appliances whose management IP is reachable only from a trusted admin network have much less exposure. No authentication is required (CVSS v4 PR:N), and the impact is availability (DoS or erratic behavior).","tier":"B","verified":{"fix":{"at":"2026-11-13T08:46:09Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3834}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc","gateway","netscaleradc","netscalergateway"],"ptokens":["adc","gateway","netscaler"],"labels":["citrix","high","infrastructure","loadbalancer","managementplane","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-120863':16A,19A '-2026':15A,18A 'adc':3A,21A 'citrix':1A 'cve':14A,17A 'denial':11A 'enabl':10A 'gateway':5A,23A 'manag':6A 'memori':8A 'netscal':2A 'netscaler':20A,22A 'overflow':9A 'plane':7A 'servic':13A","search_b":"'access':74B 'adc':49B 'balanc':28B 'behavior':58B 'caus':54B 'citrix':24B,47B 'code':70B 'data':73B 'denial':61B 'erron':57B 'execut':71B 'gateway':35B,52B 'host':38B 'infrastructur':25B 'load':27B 'load-balanc':26B 'manag':30B,44B 'management-plan':29B 'memori':40B 'netscal':32B,34B,48B,51B 'netscaler-gateway':33B 'overflow':41B 'plane':31B,45B 'possibl':76B 'say':68B 'self':37B 'self-host':36B 'servic':63B 'sourc':65B 'unpredict':55B 'whether':69B","search_c":"'adc':97C 'behavior':89C 'citrix':95C,99C 'denial':91C 'erron':88C 'gateway':101C 'lead':84C 'manag':81C 'memori':77C 'netscal':96C,100C 'overflow':78C 'plane':82C 'servic':93C 'unpredict':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120863","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120863:3834","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T08:46:09+00:00","modified_at":"2026-11-13T08:46:09+00:00","first_seen_at":"2026-11-13T08:46:09+00:00","fetched_at":"2026-11-13T08:46:09+00:00","note":"Read Citrix CTX697305 (Nov 12 2026). Mgmt-plane row matches this CVE's description and sits in id order between 120862 and 120864, but the page text drops that row's CVE id, so the mapping is inferred. Bulletin has no exploitation claim and no workaround; no per-CVE check steps. Affected versions not listed, only fixed builds.","cites":["https://support.citrix.com/external/article/CTX697305"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}