---
id: "CVE-2026-120867"
page: "https://infrastack.ai/live/CVE-2026-120867"
kind: "vulnerability"
aliases: ["CVE-2026-120867"]
title: "Citrix NetScaler ADC and Gateway: TLS 1.3 ECH or SafeNet HSM key configurations can hit a memory overflow (DoS)"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "NetScaler ADC 14.1", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1", "fixed": ["13.1-64.39"], "affected": "< 13.1-64.39", "ecosystem": "vendor"}, {"name": "NetScaler Gateway 14.1", "fixed": ["14.1-73.57"], "affected": "< 14.1-73.57", "ecosystem": "vendor"}, {"name": "NetScaler Gateway 13.1", "fixed": ["13.1-64.39"], "affected": "< 13.1-64.39", "ecosystem": "vendor"}, {"name": "NetScaler ADC 14.1-FIPS", "fixed": ["14.1-73.58"], "affected": "< 14.1-73.58", "ecosystem": "vendor"}, {"name": "NetScaler ADC 13.1-FIPS/NDcPP", "fixed": ["13.1-37.293"], "affected": "< 13.1-37.293", "ecosystem": "vendor"}]
ecosystems: []
tags: ["citrix", "ech", "hsm", "infrastructure", "load-balancer", "netscaler", "netscaler-gateway", "self-hosted", "tls", "vpn"]
not_affected_if: ["managed-hosting", "no-ech-profile", "no-safenet-hsm"]
published_at: "2026-11-13T09:17:34+00:00"
first_seen_at: "2026-11-13T09:49:53+00:00"
updated_at: "2026-11-13T09:53:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120867", "first_seen_at": "2026-11-13T09:49:53+00:00"}, {"source": "analyst", "url": "https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html", "first_seen_at": "2026-11-13T09:53:25+00:00", "cites": ["https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html"]}]
exploit_sources: []
---

# Citrix NetScaler ADC and Gateway: TLS 1.3 ECH or SafeNet HSM key configurations can hit a memory overflow (DoS)

Link for people: https://infrastack.ai/live/CVE-2026-120867 (this .md is for agents)

Citrix bulletin CTX697305 (12 Nov 2026) lists CVE-2026-120867, a memory overflow (CWE-119) in SSL/TLS/DTLS handling of NetScaler ADC and Gateway. It can cause unpredictable behavior or denial of service. CVSS v4 8.7 (network, no auth, availability impact). Only appliances with specific TLS configurations are exposed. No exploitation or public PoC is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:NetScaler ADC 14.1 affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler ADC 13.1 affected < 13.1-64.39 fixed 13.1-64.39
- vendor:NetScaler Gateway 14.1 affected < 14.1-73.57 fixed 14.1-73.57
- vendor:NetScaler Gateway 13.1 affected < 13.1-64.39 fixed 13.1-64.39
- vendor:NetScaler ADC 14.1-FIPS affected < 14.1-73.58 fixed 14.1-73.58
- vendor:NetScaler ADC 13.1-FIPS/NDcPP affected < 13.1-37.293 fixed 13.1-37.293

## How to check

- Check the build: 'show version' on the appliance. Affected if earlier than 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58, or 13.1-FIPS/13.1-NDcPP 13.1-37.293.
- Then check config: 'show running config | grep -i ech' or look for an SSL profile with ECH on a TLS1.3 vserver; and check for SSL vservers bound to a SafeNet HSM key.
- NetScaler Console Security Advisory dashboard > CVE Detection lists impacted instances (version scan only).

## Fix

Upgrade to NetScaler ADC/Gateway 14.1-73.57 or later, 13.1-64.39 or later 13.1, 14.1-FIPS 14.1-73.58 or later, or 13.1-FIPS/13.1-NDcPP 13.1-37.293 or later.

## Timeline

- 2026-11-13T09:49:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120867
- 2026-11-13T09:53:25+00:00 analyst https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html — Read Citrix bulletin CTX697305: CVE-2026-120867 needs TLS 1.3 vserver with ECH profile (also on Intel QAT/Coleto), or SSL vserver with SafeNet HSM key bound. Fixed builds listed. No exploitation or PoC seen; X/community not searched (low-profile, DoS-class, CVE-id only). Fixed builds from the bulletin; affected-below ranges inferred as everything before the fixed build.

## Documents

- [advisory] Citrix NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697305) https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html

## From the sources

Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_