Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin
Description of Problem
Multiple vulnerabilities have been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.
Affected Versions
The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities:
- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.57
- Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.39
- Citrix NetScaler ADC FIPS BEFORE 14.1-73.58 FIPS
- Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.293
Additional Note
Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities.
This bulletin only applies to customer-managed Citrix NetScaler ADC (“NetScaler ADC”) and Citrix NetScaler Gateway (“NetScaler Gateway”). Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.
Details
NetScaler ADC and NetScaler Gateway is affected by the vulnerability described below:
CVE-ID | Description | Pre-conditions | CWE | CVSSv4 |
| CVE-2026-120868 | Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service. | All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required) | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-107407 | Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC is configured with a Load Balancing (LB) or Content Switching (CS) virtual server of type SMPP. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-107408 | Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC is configured for DNS load balancing and recursive DNS resolution. | CWE-787: Out-of-bounds Write | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-107409 | Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service | NetScaler is configured with DNS Load Balancing over HTTPS (DOH). | CWE-415: Double Free | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-107410 | Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler is configured as Load Balancing (LB) virtual server of type PUSH | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-107411 | Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC is configured with a Load Balancing (LB) virtual server of type RTSP or have RTSP ALG enabled on an LSN group. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-107412 | Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service | NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 9.5(CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) |
| CVE-2026-107413 | Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC or NetScaler Gateway is configured with a SAML action | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-107414 | Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC or NetScaler Gateway is configured with a WebAuth action. | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-107415 | Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC or NetScaler Gateway is configured with an Email Action. | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-111340 | Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC or NetScaler Gateway is configured as either an LDAP action with KBAttribute or an Email action. | CWE-121: Stack-based Buffer Overflow | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-111341 | Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC or NetScaler Gateway must be configured with a certificate authentication action (CertAction) | CWE-120: Buffer Copy without Checking Size of Input | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-111342 | Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server | CWE-120: Buffer Copy without Checking Size of Input | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-111343 | Memory overflow in an authentication request can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server | CWE-120: Buffer Copy without Checking Size of Input | CVSS v4.0 Base Score: 6.9(CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-111344 | Memory overflow in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or a Denial of Service | The NetScaler appliance is configured as a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis (EPA). | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-111345 | Improper request handling can lead to a denial-of-service / reboot-loop condition | Appliance reachable as ADC/Gateway on the data path | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 6.9(CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) |
| CVE-2026-111346 | Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service | Any HTTP/SSL type virtual server with HTTP/2 enabled in the associated HTTP profile | CWE-787: Out-of-bounds Write | CVSS v4.0 Base Score: 8.3(CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-111347 | Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service | A policy containing the B64DECODE operator must be bound globally or to a virtual server of any type, and/or an Application Firewall (AppFW) must be configured | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-111348 | Sensitive authentication material written to a log file | Local read access to /var/log/httperror.log on an appliance where any logout had occurred | CWE-532: Insertion of Sensitive Information into Log File | CVSS v4.0 Base Score:6.9(CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L) |
| CVE-2026-111349 | Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service. | AppFW profile with affected protections (XML protection, multipart form-data, content-type inference, request-body signature or API Security/gRPC/OpenAPI spec) | CWE-122: Heap-based Buffer Overflow | CVSS v4.0 Base Score:6.9(CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L) |
| CVE-2026-120860 | Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service. | NetScaler ADC must be configured as a Load Balancing (LB) virtual server of type DIAMETER, SIP_TCP, MQTT, or RADIUS. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-120861 | Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service. | The NetScaler appliance must have any of the following configured: a GSLB site with Metric Exchange Protocol (MEP) enabled, GSLB static proximity, a geolocation responder policy, or GSLB automatic configuration synchronization. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-120862 | Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service. | The NetScaler appliance must have SIP ALG enabled on an LSN group OR DNS answer-section security logging enabled in a DNS profile. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-120863 | Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service | An attacker on an untrusted host must be able to reach the NetScaler appliance’s NSIP or NSIP6 address. | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-120864 | Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service. | The appliance must be configured as a Gateway vpn virtual server or an AAA virtual server or CR virtual server of type HDX | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 9.3(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) |
| CVE-2026-120865 | Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service. | The NetScaler appliance must be configured as a Load Balancing (LB) or Content Switching (CS) virtual server of type HTTP_QUIC | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-120866 | Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service. | BGP dynamic routing must be enabled with a configured neighbor and without TCP-MD5 authentication for that neighbor. The attacker must be, or be able to spoof, the configured neighbor. | CWE-787: Out-of-bounds Write | CVSS v4.0 Base Score: 7.7(CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L) |
| CVE-2026-120867 | Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service. | The NetScaler appliance must be configured with TLS 1.3 vserver with ECH profile configuredOrTLS 1.3 vserver on Intel QAT (Coleto) Platforms with ECH profile configuredOrSSL vserver with SafeNet HSM Key bound | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS v4.0 Base Score: 8.7(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L) |
Recommended Action
Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.
- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.57 and later releases
- Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.39 and later releases of 13.1
- Citrix NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS and later releases of 14.1-FIPS
- Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later releases of 13.1-FIPS and 13.1-NDcPP