NETSCALER ADC 14.1 · CVE-2026-120867 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293 ✓ verified
Citrix bulletin CTX697305 (12 Nov 2026) lists CVE-2026-120867, a memory overflow (CWE-119) in SSL/TLS/DTLS handling of NetScaler ADC and Gateway. It can cause unpredictable behavior or denial of service. CVSS v4 8.7 (network, no auth, availability impact). Only appliances with specific TLS configurations are exposed. No exploitation or public PoC is reported.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
NetScaler ADC and NetScaler Gateway appliances are exposed only if they have a TLS 1.3 virtual server with an ECH profile configured (including on Intel QAT/Coleto platforms), or an SSL virtual server with a SafeNet HSM key bound. Appliances without those settings are not listed by Citrix as exposed to this CVE. Network-reachable with no authentication per the CVSS vector.
Not affected if managed-hosting, no-ech-profile, no-safenet-hsm
Who cares citrix, ech, hsm, load-balancer, netscaler, netscaler-gateway, self-hosted, tls, vpn
Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58 · 13.1-37.293
Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.