{"id":"CVE-2026-120864","kind":"vulnerability","aliases":["CVE-2026-120864"],"related":[],"title":"Citrix NetScaler ADC and Gateway: memory overflow in ICA proxy can cause denial of service","description":"Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in the ICA proxy of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state whether code execution or data access is possible.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC and Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58 FIPS"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS and NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","hdx","ica-proxy","infrastructure","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["managed-hosting","no-cr-vserver-hdx","no-gateway-or-aaa-vserver","unknown"],"how_to_check":"Run on the appliance config (ns.conf): look for 'add vpn vserver', 'add authentication vserver', or 'add cr vserver <name> HDX'. Citrix says any of these (Gateway vpn vserver, AAA vserver, or CR vserver of type HDX) meets the precondition. Then check the build with 'show ns version': exposed if below 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP. Citrix also says Secure Private Access Hybrid deployments that use NetScaler instances are affected. NetScaler Console's security advisory dashboard (CVE Detection) lists impacted instances.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later, 14.1-73.58 FIPS or later (ADC FIPS), or 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). Citrix names no workaround.","status":"open","published_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","triaged_at":"2026-11-13T09:51:56+00:00","updated_at":"2026-11-13T09:53:36+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T09:51:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: memory overflow in ICA proxy enables denial of service","impact":"medium","summary":"A memory overflow in the ICA proxy of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state whether code execution or data access is possible.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance becomes unstable or crashes, causing denial of service","analyst_note":"Find Citrix's own advisory for CVE-2026-120864 to get affected and fixed versions and whether the ICA proxy must be enabled; the NVD entry alone gives neither.","how_to_check":"- Check the NetScaler ADC and NetScaler Gateway firmware build against the vendor's advisory for CVE-2026-120864 (unknown: the sources give no affected version ranges)\n- Confirm whether the ICA proxy feature is in use on the appliance (unknown: the sources do not say how to check)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway appliances with the ICA proxy in use are exposed. The sources do not state which versions or configurations are affected, so teams should confirm against Citrix's own advisory.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000746,"input_tokens":4524,"output_tokens":588,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Citrix's own advisory for CVE-2026-120864 to get affected and fixed versions and whether the ICA proxy must be enabled; the NVD entry alone gives neither.","search":"'-120864':18A,21A '-2026':17A,20A '13.1':31A,38A '14.1':26A,34A 'access':88B 'adc':3A,23A,28A,33A,37A,65B,110C 'and':24A,29A,40A 'behavior':72B,102C 'caus':12A,70B 'citrix':1A,42B,63B,108C,112C 'code':84B 'cve':16A,19A 'data':87B 'denial':13A,75B,104C 'erron':101C 'execut':85B 'fips':35A,39A 'gateway':5A,25A,30A,51B,68B,114C 'hdx':43B 'host':54B 'ica':9A,45B,60B,94C 'ica-proxi':44B 'infrastructur':47B 'lead':97C 'memori':6A,56B,91C 'ndcpp':41A 'netscal':2A,48B,50B,64B,67B,109C,113C 'netscaler':22A,27A,32A,36A 'netscaler-gateway':49B 'overflow':7A,57B,92C 'possibl':90B 'proxi':10A,46B,61B,95C 'self':53B 'self-host':52B 'servic':15A,77B,106C 'sourc':79B 'state':82B 'unpredict':71B,99C 'whether':83B","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances you run yourself are affected if they are configured as a Gateway vpn virtual server, an AAA virtual server, or a CR virtual server of type HDX, and run a build older than the fixed ones. Citrix rates it CVSS v4 9.3 with network access, no privileges and no user interaction, and describes the effect as unpredictable behavior or denial of service. Appliances without those virtual servers do not meet the precondition. Citrix does not say whether it is exploited, and no public PoC was found.","tier":"B","verified":{"fix":{"at":"2026-11-13T09:53:36Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3842},"products":{"at":"2026-11-13T09:53:36Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3842},"how_to_check":{"at":"2026-11-13T09:53:36Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3842},"who_affected":{"at":"2026-11-13T09:53:36Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3842}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc131fipsandndcpp","adc141fips","adcandgateway131","adcandgateway141","netscaleradc131fipsandndcpp","netscaleradc141fips","netscaleradcandgateway131","netscaleradcandgateway141"],"ptokens":["13","14","adc","and","fips","gateway","ndcpp","netscaler"],"labels":["citrix","critical","hdx","icaproxy","infrastructure","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-120864':18A,21A '-2026':17A,20A '13.1':31A,38A '14.1':26A,34A 'adc':3A,23A,28A,33A,37A 'and':24A,29A,40A 'caus':12A 'citrix':1A 'cve':16A,19A 'denial':13A 'fips':35A,39A 'gateway':5A,25A,30A 'ica':9A 'memori':6A 'ndcpp':41A 'netscal':2A 'netscaler':22A,27A,32A,36A 'overflow':7A 'proxi':10A 'servic':15A","search_b":"'access':88B 'adc':65B 'behavior':72B 'caus':70B 'citrix':42B,63B 'code':84B 'data':87B 'denial':75B 'execut':85B 'gateway':51B,68B 'hdx':43B 'host':54B 'ica':45B,60B 'ica-proxi':44B 'infrastructur':47B 'memori':56B 'netscal':48B,50B,64B,67B 'netscaler-gateway':49B 'overflow':57B 'possibl':90B 'proxi':46B,61B 'self':53B 'self-host':52B 'servic':77B 'sourc':79B 'state':82B 'unpredict':71B 'whether':83B","search_c":"'adc':110C 'behavior':102C 'citrix':108C,112C 'denial':104C 'erron':101C 'gateway':114C 'ica':94C 'lead':97C 'memori':91C 'netscal':109C,113C 'overflow':92C 'proxi':95C 'servic':106C 'unpredict':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120864","severity":null,"published_at":"2026-11-13T09:17:34+00:00","modified_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","fetched_at":"2026-11-13T09:49:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120864:3842","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T09:53:36+00:00","modified_at":"2026-11-13T09:53:36+00:00","first_seen_at":"2026-11-13T09:53:36+00:00","fetched_at":"2026-11-13T09:53:36+00:00","note":"Read Citrix bulletin CTX697305 (Nov 12 2026): preconditions, affected/fixed builds, no workaround stated, exploitation not stated. Part of a 28-CVE bulletin; all fixed by the same builds. Web search worked; X not checked (no CVE-specific chatter expected, skipped to save credits). No check written: the condition lives in appliance ns.conf, not in a repository.","cites":["https://support.citrix.com/external/article/CTX697305","https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":144505,"url":"https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/","title":"SecurityWeek: Citrix Patches 10 Critical NetScaler Vulnerabilities","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}