---
id: "CVE-2026-120864"
page: "https://infrastack.ai/live/CVE-2026-120864"
kind: "vulnerability"
aliases: ["CVE-2026-120864"]
title: "Citrix NetScaler ADC and Gateway: memory overflow in ICA proxy can cause denial of service"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC and Gateway 14.1", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler ADC and Gateway 13.1", "fixed": ["13.1-64.39"], "affected": "< 13.1-64.39", "ecosystem": "vendor"}, {"name": "NetScaler ADC 14.1-FIPS", "fixed": ["14.1-73.58 FIPS"], "affected": "< 14.1-73.58", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1-FIPS and NDcPP", "fixed": ["13.1-37.293"], "affected": "< 13.1-37.293", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "hdx", "ica-proxy", "infrastructure", "netscaler", "netscaler-gateway", "self-hosted"]
not_affected_if: ["managed-hosting", "no-cr-vserver-hdx", "no-gateway-or-aaa-vserver", "unknown"]
published_at: "2026-11-13T09:17:34+00:00"
first_seen_at: "2026-11-13T09:49:53+00:00"
updated_at: "2026-11-13T09:53:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120864", "first_seen_at": "2026-11-13T09:49:53+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305", "first_seen_at": "2026-11-13T09:53:36+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305", "https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/"]}]
exploit_sources: []
---

# Citrix NetScaler ADC and Gateway: memory overflow in ICA proxy can cause denial of service

Link for people: https://infrastack.ai/live/CVE-2026-120864 (this .md is for agents)

A memory overflow in the ICA proxy of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state whether code execution or data access is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC and Gateway 14.1 affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler ADC and Gateway 13.1 affected < 13.1-64.39 fixed 13.1-64.39
- vendor:NetScaler ADC 14.1-FIPS affected < 14.1-73.58 fixed 14.1-73.58 FIPS
- vendor:NetScaler ADC 13.1-FIPS and NDcPP affected < 13.1-37.293 fixed 13.1-37.293

## How to check

Run on the appliance config (ns.conf): look for 'add vpn vserver', 'add authentication vserver', or 'add cr vserver <name> HDX'. Citrix says any of these (Gateway vpn vserver, AAA vserver, or CR vserver of type HDX) meets the precondition. Then check the build with 'show ns version': exposed if below 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP. Citrix also says Secure Private Access Hybrid deployments that use NetScaler instances are affected. NetScaler Console's security advisory dashboard (CVE Detection) lists impacted instances.

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later, 14.1-73.58 FIPS or later (ADC FIPS), or 13.1-37.293 or later (13.1-FIPS and 13.1-NDcPP). Citrix names no workaround.

## Timeline

- 2026-11-13T09:49:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120864
- 2026-11-13T09:53:36+00:00 analyst https://support.citrix.com/external/article/CTX697305 — Read Citrix bulletin CTX697305 (Nov 12 2026): preconditions, affected/fixed builds, no workaround stated, exploitation not stated. Part of a 28-CVE bulletin; all fixed by the same builds. Web search worked; X not checked (no CVE-specific chatter expected, skipped to save credits). No check written: the condition lives in appliance ns.conf, not in a repository.

## Documents

- [advisory] Citrix NetScaler ADC and Gateway Security Bulletin CTX697305 https://support.citrix.com/external/article/CTX697305
- [mentions] SecurityWeek: Citrix Patches 10 Critical NetScaler Vulnerabilities https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/

## From the sources

Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_