{"id":"CVE-2026-120867","kind":"vulnerability","aliases":["CVE-2026-120867"],"related":[],"title":"Citrix NetScaler ADC and Gateway: TLS 1.3 ECH or SafeNet HSM key configurations can hit a memory overflow (DoS)","description":"Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.","summary":"Citrix bulletin CTX697305 (12 Nov 2026) lists CVE-2026-120867, a memory overflow (CWE-119) in SSL/TLS/DTLS handling of NetScaler ADC and Gateway. It can cause unpredictable behavior or denial of service. CVSS v4 8.7 (network, no auth, availability impact). Only appliances with specific TLS configurations are exposed. No exploitation or public PoC is reported.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC 14.1-FIPS","fixed":["14.1-73.58"],"affected":"< 14.1-73.58","ecosystem":"vendor"},{"name":"NetScaler ADC 13.1-FIPS/NDcPP","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","ech","hsm","infrastructure","load-balancer","netscaler","netscaler-gateway","self-hosted","tls","vpn"],"not_affected_if":["managed-hosting","no-ech-profile","no-safenet-hsm"],"how_to_check":"- Check the build: 'show version' on the appliance. Affected if earlier than 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, or 13.1-FIPS/13.1-NDcPP 13.1-37.293.\n- Then check config: 'show running config | grep -i ech' or look for an SSL profile with ECH on a TLS1.3 vserver; and check for SSL vservers bound to a SafeNet HSM key.\n- NetScaler Console Security Advisory dashboard > CVE Detection lists impacted instances (version scan only).","fix":"Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.","status":"open","published_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","triaged_at":"2026-11-13T09:51:56+00:00","updated_at":"2026-11-13T09:53:25+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-13T09:51:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler: SSL/TLS memory overflow can crash the appliance","impact":"medium","summary":"A memory overflow in the SSL, TLS and DTLS handling of Citrix NetScaler ADC and NetScaler Gateway can cause unpredictable behavior or a denial of service. The sources do not say whether an attacker can run code or read data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler","netscaler-gateway","load-balancer","vpn"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler builds and whether the flaw is remotely triggerable without authentication.","how_to_check":"- Check the NetScaler ADC or NetScaler Gateway firmware build against the fixed versions listed by Citrix (unknown in the sources given)\n- Confirm whether the appliance is reachable from the internet, since the sources do not state the attack vector","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Citrix NetScaler ADC or NetScaler Gateway appliances are the ones exposed. The sources do not name affected versions, the triggering traffic, or any special configuration, so whether a given deployment is vulnerable is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4535,"output_tokens":568,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Citrix security bulletin for affected and fixed NetScaler builds and whether the flaw is remotely triggerable without authentication.","search":"'-119':76B '-120867':22A,25A,71B '-2026':21A,24A,70B '1.3':7A '12':65B '13.1':31A,37A,44A '14.1':28A,34A,40A '2026':67B '8.7':96B 'adc':3A,27A,30A,39A,43A,82B,135C 'applianc':103B 'auth':99B 'avail':100B 'balanc':52B 'behavior':89B,127C 'bulletin':63B 'caus':87B 'citrix':1A,46B,62B,133C,137C 'configur':13A,107B 'ctx697305':64B 'cve':20A,23A,69B 'cvss':94B 'cwe':75B 'denial':91B,129C 'dos':19A 'ech':8A,47B 'erron':126C 'exploit':111B 'expos':109B 'fips':41A 'fips/ndcpp':45A 'gateway':5A,33A,36A,56B,84B,139C 'handl':79B 'hit':15A 'host':59B 'hsm':11A,48B 'impact':101B 'infrastructur':49B 'key':12A 'lead':122C 'list':68B 'load':51B 'load-balanc':50B 'memori':17A,73B,117C 'netscal':2A,53B,55B,81B,134C,138C 'netscaler':26A,29A,32A,35A,38A,42A 'netscaler-gateway':54B 'network':97B 'nov':66B 'overflow':18A,74B,118C 'poc':114B 'public':113B 'report':116B 'safenet':10A 'self':58B 'self-host':57B 'servic':93B,131C 'specif':105B 'ssl/tls/dtls':78B,120C 'tls':6A,60B,106B 'unpredict':88B,124C 'v4':95B 'vpn':61B","nicknames":[],"mitigations":[],"who_affected":"NetScaler ADC and NetScaler Gateway appliances are exposed only if they have a TLS 1.3 virtual server with an ECH profile configured (including on Intel QAT/Coleto platforms), or an SSL virtual server with a SafeNet HSM key bound. Appliances without those settings are not listed by Citrix as exposed to this CVE. Network-reachable with no authentication per the CVSS vector.","tier":"B","verified":{"fix":{"at":"2026-11-13T09:53:25Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3843},"how_to_check":{"at":"2026-11-13T09:53:25Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3843},"who_affected":{"at":"2026-11-13T09:53:25Z","by":"analyst","doc":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","run_id":3843}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adc131","adc131fipsndcpp","adc141","adc141fips","gateway131","gateway141","netscaleradc131","netscaleradc131fipsndcpp","netscaleradc141","netscaleradc141fips","netscalergateway131","netscalergateway141"],"ptokens":["13","14","adc","fips","gateway","ndcpp","netscaler"],"labels":["citrix","ech","high","hsm","infrastructure","loadbalancer","netscaler","netscalergateway","selfhosted","tls","vpn"],"campaign_type":null,"search_a":"'-120867':22A,25A '-2026':21A,24A '1.3':7A '13.1':31A,37A,44A '14.1':28A,34A,40A 'adc':3A,27A,30A,39A,43A 'citrix':1A 'configur':13A 'cve':20A,23A 'dos':19A 'ech':8A 'fips':41A 'fips/ndcpp':45A 'gateway':5A,33A,36A 'hit':15A 'hsm':11A 'key':12A 'memori':17A 'netscal':2A 'netscaler':26A,29A,32A,35A,38A,42A 'overflow':18A 'safenet':10A 'tls':6A","search_b":"'-119':76B '-120867':71B '-2026':70B '12':65B '2026':67B '8.7':96B 'adc':82B 'applianc':103B 'auth':99B 'avail':100B 'balanc':52B 'behavior':89B 'bulletin':63B 'caus':87B 'citrix':46B,62B 'configur':107B 'ctx697305':64B 'cve':69B 'cvss':94B 'cwe':75B 'denial':91B 'ech':47B 'exploit':111B 'expos':109B 'gateway':56B,84B 'handl':79B 'host':59B 'hsm':48B 'impact':101B 'infrastructur':49B 'list':68B 'load':51B 'load-balanc':50B 'memori':73B 'netscal':53B,55B,81B 'netscaler-gateway':54B 'network':97B 'nov':66B 'overflow':74B 'poc':114B 'public':113B 'report':116B 'self':58B 'self-host':57B 'servic':93B 'specif':105B 'ssl/tls/dtls':78B 'tls':60B,106B 'unpredict':88B 'v4':95B 'vpn':61B","search_c":"'adc':135C 'behavior':127C 'citrix':133C,137C 'denial':129C 'erron':126C 'gateway':139C 'lead':122C 'memori':117C 'netscal':134C,138C 'overflow':118C 'servic':131C 'ssl/tls/dtls':120C 'unpredict':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T09:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120867","severity":null,"published_at":"2026-11-13T09:17:34+00:00","modified_at":"2026-11-13T09:17:34+00:00","first_seen_at":"2026-11-13T09:49:53+00:00","fetched_at":"2026-11-13T09:49:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120867:3843","url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","severity":null,"published_at":"2026-11-13T09:53:25+00:00","modified_at":"2026-11-13T09:53:25+00:00","first_seen_at":"2026-11-13T09:53:25+00:00","fetched_at":"2026-11-13T09:53:25+00:00","note":"Read Citrix bulletin CTX697305: CVE-2026-120867 needs TLS 1.3 vserver with ECH profile (also on Intel QAT/Coleto), or SSL vserver with SafeNet HSM key bound. Fixed builds listed. No exploitation or PoC seen; X/community not searched (low-profile, DoS-class, CVE-id only). Fixed builds from the bulletin; affected-below ranges inferred as everything before the fixed build.","cites":["https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html"]}],"documents":[{"id":142461,"url":"https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html","title":"Citrix NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697305)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}