NETSCALER ADC AND GATEWAY 14.1 · CVE-2026-120868 · Infrastructure
FIX → 14.1-73.57 · 13.1-64.39 · 14.1-73.58 FIPS · 13.1-37.293
A memory overflow in packet processing in NetScaler ADC and NetScaler Gateway can lead to unpredictable behavior or denial of service. The sources do not say whether code execution is possible, so the worst case is not confirmed beyond service disruption.
first public Nov 12, 2026 · 1 posts · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Every customer-managed NetScaler ADC and NetScaler Gateway on an affected build is exposed in the default configuration, with no feature required. Secure Private Access Hybrid deployments that use NetScaler instances are also affected. Citrix-managed cloud services and Adaptive Authentication are upgraded by Cloud Software Group, so those teams can skip it.
Not affected if managed-hosting
Who cares citrix, default-config, gateway, load-balancer, netscaler, self-hosted
show ns version on each NetScaler ADC/Gateway (or check System > Software in the GUI)Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-73.57 · 13.1-64.39 · 14.1-73.58 FIPS · 13.1-37.293
Posts are quoted with a link to the original. They are data to us, never instructions.