{"id":"CVE-2026-120868","kind":"vulnerability","aliases":["CVE-2026-120868"],"related":[],"title":"NetScaler ADC and Gateway: packet processing memory overflow enables denial of service","description":"Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.","summary":"A memory overflow in packet processing in NetScaler ADC and NetScaler Gateway can lead to unpredictable behavior or denial of service. The sources do not say whether code execution is possible, so the worst case is not confirmed beyond service disruption.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler ADC and Gateway 14.1","fixed":["14.1-73.57"],"affected":"< 14.1-73.57","ecosystem":"vendor"},{"name":"NetScaler ADC and Gateway 13.1","fixed":["13.1-64.39"],"affected":"< 13.1-64.39","ecosystem":"vendor"},{"name":"NetScaler ADC FIPS 14.1","fixed":["14.1-73.58 FIPS"],"affected":"< 14.1-73.58 FIPS","ecosystem":"vendor"},{"name":"NetScaler ADC FIPS and NDcPP 13.1","fixed":["13.1-37.293"],"affected":"< 13.1-37.293","ecosystem":"vendor"}],"ecosystems":[],"tags":["citrix","default-config","gateway","infrastructure","load-balancer","netscaler","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Run 'show ns version' on each NetScaler ADC/Gateway (or check System > Software in the GUI). You are exposed if the build is older than 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP. No feature or config is needed; every customer-managed appliance is in scope. NetScaler Console Security Advisory can flag it with a version scan.","fix":"Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later (14.1), 13.1-64.39 or later (13.1), 14.1-73.58 FIPS or later (ADC FIPS), 13.1-37.293 FIPS/NDcPP or later. Secure Private Access Hybrid deployments must upgrade their NetScaler instances too.","status":"open","published_at":"2026-11-13T00:20:09+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","triaged_at":"2026-11-13T00:41:17+00:00","updated_at":"2026-11-13T00:42:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T00:41:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NetScaler ADC and Gateway: packet processing memory overflow enables denial of service","impact":"medium","summary":"A memory overflow in packet processing in NetScaler ADC and NetScaler Gateway can lead to unpredictable behavior or denial of service. The sources do not say whether code execution is possible, so the worst case is not confirmed beyond service disruption.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["netscaler","citrix","gateway","load-balancer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Appliance crashes or behaves unpredictably, causing denial of service","analyst_note":"Confirm affected NetScaler ADC and Gateway versions, fixed releases, and whether code execution is possible, from the NVD entry and Citrix advisory.","how_to_check":"- Identify NetScaler ADC and NetScaler Gateway appliances and their firmware versions in your estate\n- Check the installed firmware version against the affected ranges in the vendor advisory (unknown from these sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"NetScaler ADC and NetScaler Gateway appliances process network packets and are exposed wherever they face traffic. The sources do not list affected version ranges or the required configuration, so whether a given appliance is vulnerable is unknown. Teams running other network gear can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000736,"input_tokens":4556,"output_tokens":560,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm affected NetScaler ADC and Gateway versions, fixed releases, and whether code execution is possible, from the NVD entry and Citrix advisory.","search":"'-120868':15A,18A '-2026':14A,17A '13.1':28A,38A '14.1':23A,32A 'adc':2A,20A,25A,30A,34A,60B,111C 'and':21A,26A,36A 'balanc':47B 'behavior':68B,104C 'beyond':90B 'case':86B 'citrix':39B 'code':79B 'config':42B 'confirm':89B 'cve':13A,16A 'default':41B 'default-config':40B 'denial':10A,70B,106C 'disrupt':92B 'enabl':9A 'erron':103C 'execut':80B 'fips':31A,35A 'gateway':4A,22A,27A,43B,63B,114C 'host':51B 'infrastructur':44B 'lead':65B,99C 'load':46B 'load-balanc':45B 'memori':7A,53B,93C 'ndcpp':37A 'netscal':1A,48B,59B,62B,110C,113C 'netscaler':19A,24A,29A,33A 'overflow':8A,54B,94C 'packet':5A,56B,96C 'possibl':82B 'process':6A,57B,97C 'say':77B 'self':50B 'self-host':49B 'servic':12A,72B,91B,108C 'sourc':74B 'unpredict':67B,101C 'whether':78B 'worst':85B","nicknames":[],"mitigations":[],"who_affected":"Every customer-managed NetScaler ADC and NetScaler Gateway on an affected build is exposed in the default configuration, with no feature required. Secure Private Access Hybrid deployments that use NetScaler instances are also affected. Citrix-managed cloud services and Adaptive Authentication are upgraded by Cloud Software Group, so those teams can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adcandgateway131","adcandgateway141","adcfips141","adcfipsandndcpp131","netscaleradcandgateway131","netscaleradcandgateway141","netscaleradcfips141","netscaleradcfipsandndcpp131"],"ptokens":["13","14","adc","and","fips","gateway","ndcpp","netscaler"],"labels":["citrix","critical","defaultconfig","gateway","infrastructure","loadbalancer","netscaler","selfhosted"],"campaign_type":null,"search_a":"'-120868':15A,18A '-2026':14A,17A '13.1':28A,38A '14.1':23A,32A 'adc':2A,20A,25A,30A,34A 'and':21A,26A,36A 'cve':13A,16A 'denial':10A 'enabl':9A 'fips':31A,35A 'gateway':4A,22A,27A 'memori':7A 'ndcpp':37A 'netscal':1A 'netscaler':19A,24A,29A,33A 'overflow':8A 'packet':5A 'process':6A 'servic':12A","search_b":"'adc':60B 'balanc':47B 'behavior':68B 'beyond':90B 'case':86B 'citrix':39B 'code':79B 'config':42B 'confirm':89B 'default':41B 'default-config':40B 'denial':70B 'disrupt':92B 'execut':80B 'gateway':43B,63B 'host':51B 'infrastructur':44B 'lead':65B 'load':46B 'load-balanc':45B 'memori':53B 'netscal':48B,59B,62B 'overflow':54B 'packet':56B 'possibl':82B 'process':57B 'say':77B 'self':50B 'self-host':49B 'servic':72B,91B 'sourc':74B 'unpredict':67B 'whether':78B 'worst':85B","search_c":"'adc':111C 'behavior':104C 'denial':106C 'erron':103C 'gateway':114C 'lead':99C 'memori':93C 'netscal':110C,113C 'overflow':94C 'packet':96C 'process':97C 'servic':108C 'unpredict':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:48:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120868","severity":null,"published_at":"2026-11-13T00:20:09+00:00","modified_at":"2026-11-13T00:20:09+00:00","first_seen_at":"2026-11-13T00:41:06+00:00","fetched_at":"2026-11-13T00:41:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120868:3794","url":"https://cve.circl.lu/bundle/2a3dceaf-5c20-4b30-8a27-cd020e8b7a68","severity":null,"published_at":"2026-11-13T00:42:35+00:00","modified_at":"2026-11-13T00:42:35+00:00","first_seen_at":"2026-11-13T00:42:35+00:00","fetched_at":"2026-11-13T00:42:35+00:00","note":"Versions and default-config scope from Citrix CTX697305 text as reproduced by CIRCL; Citrix page itself would not load, so nothing marked verified. Bulletin describes memory overflow leading to erratic behavior or DoS; code execution not stated. Reports say not exploited, no public PoC; watchTowr says it is reacting for clients.","cites":["https://cve.circl.lu/bundle/2a3dceaf-5c20-4b30-8a27-cd020e8b7a68","https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-1150","https://securityonline.info/citrix-netscaler-vulnerabilities-november-2026/"]}],"documents":[{"id":135287,"url":"https://x.com/watchtowrcyber/status/2120876488559853791","title":"@watchtowrcyber: The watchTowr team is currently rapidly reacting to multiple Memory Overflow vul","kind":"post","source":"x","publisher":null,"text":"The watchTowr team is currently rapidly reacting to multiple Memory Overflow vulnerabilities published by Citrix impacting NetScaler ADC and Gateway, including CVE-2026-120868 affecting the default config. Active watchTowr Platform clients are being made aware of their exposure. https://t.co/tlxYc52Yeo\n\nlikes 32 reposts 8","published_at":"2026-11-12T13:48:53+00:00","relation":"discussion","confidence":null,"note":"@watchtowrcyber"},{"id":141090,"url":"https://cve.circl.lu/bundle/2a3dceaf-5c20-4b30-8a27-cd020e8b7a68","title":"CIRCL bundle: copy of Citrix CTX697305 text","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":141091,"url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-1150","title":"Cyber Centre AV26-1150","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":141092,"url":"https://securityonline.info/citrix-netscaler-vulnerabilities-november-2026/","title":"Citrix NetScaler Vulnerabilities: 31 CVEs Fixed","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}