{"id":"CVE-2026-120866","kind":"vulnerability","aliases":["CVE-2026-120866"],"related":[],"title":"Citrix NetScaler: BGP routing memory overflow enables denial of service","description":"Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"A memory overflow in the BGP dynamic routing feature of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC and Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58 FIPS"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS and 13.1-NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["adc","bgp","citrix","gateway","infrastructure","load-balancer","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["no-bgp-dynamic-routing","no-bgp-neighbor-configured","tcp-md5-authentication"],"how_to_check":"On the appliance run 'show ns feature' (BGP must be enabled) and 'show router dynamicRouting' (look for 'router bgp <ASN>' with at least one 'neighbor <IP> remote-as <ASN>'). If BGP is off or no neighbor is configured, Citrix says the appliance is not vulnerable. Also check that each neighbor has TCP-MD5 authentication; the bulletin gives no command for that. Then compare 'show version' with the fixed builds. Also check Secure Private Access Hybrid deployments that use NetScaler instances; the bulletin says they must be upgraded.","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later; ADC 14.1-FIPS 14.1-73.58 FIPS or later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later. Bulletin lists no mitigation or workaround.","status":"open","published_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","triaged_at":"2026-11-13T09:52:00+00:00","updated_at":"2026-11-13T09:53:45+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-13T09:52:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Citrix NetScaler: BGP routing memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in the BGP dynamic routing feature of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not state that an attacker can run code or read data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","bgp","load-balancer"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance behaves erratically or stops serving traffic","analyst_note":"Pull the NVD entry and Citrix security bulletin to confirm affected versions, fixed versions, and whether BGP must be enabled to be exposed.","how_to_check":"- Check whether BGP dynamic routing is enabled on the NetScaler ADC or Gateway appliance (unknown whether a specific command or setting is named in the sources).\n- Confirm the installed firmware version against the affected ranges (unknown in the sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-bgp-dynamic-routing"],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway with BGP dynamic routing are the ones this description concerns. The sources do not list affected version ranges or whether a non-default configuration is required. Teams not running these appliances can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4531,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Pull the NVD entry and Citrix security bulletin to confirm affected versions, fixed versions, and whether BGP must be enabled to be exposed.","search":"'-120866':13A,16A '-2026':12A,15A '13.1':26A,33A,36A '14.1':21A,29A 'adc':18A,23A,28A,32A,38B,65B,114C 'and':19A,24A,35A 'attack':85B 'balanc':45B 'behavior':72B,106C 'bgp':3A,39B,58B,97C 'caus':70B 'citrix':1A,40B,63B,112C,116C 'code':88B 'cve':11A,14A 'data':91B 'denial':8A,75B,108C 'dynam':59B,98C 'enabl':7A 'erron':105C 'featur':61B 'fips':30A,34A 'gateway':20A,25A,41B,49B,68B,118C 'handl':95C 'host':52B 'improp':94C 'infrastructur':42B 'lead':101C 'load':44B 'load-balanc':43B 'memori':5A,54B,92C 'ndcpp':37A 'netscal':2A,46B,48B,64B,67B,113C,117C 'netscaler':17A,22A,27A,31A 'netscaler-gateway':47B 'overflow':6A,55B,93C 'read':90B 'rout':4A,60B,99C 'run':87B 'self':51B 'self-host':50B 'servic':10A,77B,110C 'sourc':79B 'state':82B 'unpredict':71B,103C","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and Gateway appliances older than the fixed builds are exposed only when BGP dynamic routing is enabled with a configured neighbor that has no TCP-MD5 authentication. The attacker must be, or be able to spoof, that neighbor (adjacent network, high complexity). Citrix describes the impact as unpredictable behavior or denial of service. Appliances without BGP, or with TCP-MD5 on every neighbor, can skip it, but should still update because the same bulletin covers many other CVEs.","tier":"B","verified":{"fix":{"at":"2026-11-13T09:53:45Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3844},"products":{"at":"2026-11-13T09:53:45Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3844},"how_to_check":{"at":"2026-11-13T09:53:45Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3844},"who_affected":{"at":"2026-11-13T09:53:45Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305","run_id":3844}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc131fipsand131ndcpp","adc141fips","adcandgateway131","adcandgateway141","netscaleradc131fipsand131ndcpp","netscaleradc141fips","netscaleradcandgateway131","netscaleradcandgateway141"],"ptokens":["13","14","adc","and","fips","gateway","ndcpp","netscaler"],"labels":["adc","bgp","citrix","gateway","high","infrastructure","loadbalancer","netscaler","netscalergateway","selfhosted"],"campaign_type":null,"search_a":"'-120866':13A,16A '-2026':12A,15A '13.1':26A,33A,36A '14.1':21A,29A 'adc':18A,23A,28A,32A 'and':19A,24A,35A 'bgp':3A 'citrix':1A 'cve':11A,14A 'denial':8A 'enabl':7A 'fips':30A,34A 'gateway':20A,25A 'memori':5A 'ndcpp':37A 'netscal':2A 'netscaler':17A,22A,27A,31A 'overflow':6A 'rout':4A 'servic':10A","search_b":"'adc':38B,65B 'attack':85B 'balanc':45B 'behavior':72B 'bgp':39B,58B 'caus':70B 'citrix':40B,63B 'code':88B 'data':91B 'denial':75B 'dynam':59B 'featur':61B 'gateway':41B,49B,68B 'host':52B 'infrastructur':42B 'load':44B 'load-balanc':43B 'memori':54B 'netscal':46B,48B,64B,67B 'netscaler-gateway':47B 'overflow':55B 'read':90B 'rout':60B 'run':87B 'self':51B 'self-host':50B 'servic':77B 'sourc':79B 'state':82B 'unpredict':71B","search_c":"'adc':114C 'behavior':106C 'bgp':97C 'citrix':112C,116C 'denial':108C 'dynam':98C 'erron':105C 'gateway':118C 'handl':95C 'improp':94C 'lead':101C 'memori':92C 'netscal':113C,117C 'overflow':93C 'rout':99C 'servic':110C 'unpredict':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120866","severity":null,"published_at":"2026-11-13T09:17:34+00:00","modified_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","fetched_at":"2026-11-13T09:49:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120866:3844","url":"https://support.citrix.com/external/article/CTX697305","severity":null,"published_at":"2026-11-13T09:53:45+00:00","modified_at":"2026-11-13T09:53:45+00:00","first_seen_at":"2026-11-13T09:53:45+00:00","fetched_at":"2026-11-13T09:53:45+00:00","note":"Read Citrix bulletin CTX697305 (via WebFetch; web-cli get truncated before the precondition steps). Fixed builds, BGP precondition and check commands taken from it. No exploitation or PoC found; X not searched.","cites":["https://support.citrix.com/external/article/CTX697305","https://support.citrix.com/external/article/CTX697305","https://nvd.nist.gov/vuln/detail/CVE-2026-120866"]}],"documents":[{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":142058,"url":"https://support.citrix.com/external/article/CTX697305","title":"Citrix NetScaler ADC and Gateway Security Bulletin CTX697305","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":144508,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120866","title":"NVD CVE-2026-120866","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}