CVE-2026-120862: Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This NetScaler advisory covers CVE-2026-120862 in NetScaler ADC and NetScaler Gateway.
- CVE-2026-120862
Key facts
- Vendor rating
- High, CVSS 8.7
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L· base score 8.7, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: low. Availability impact on subsequent systems: low.- EPSS
- 0.31% chance of exploitation in the next 30 days (24th percentile). FIRST EPSS, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- NetScaler ADC before 14.1-73.57; NetScaler ADC before 13.1-64.39; NetScaler ADC before 14.1-73.58 FIPS and 3 more below
- Fixed in
- 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 1 more below
- Source published
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Affected products named by the advisory: NetScaler ADC; NetScaler Gateway.
Text from the source record.
- NetScaler ADC before 14.1-73.57
- NetScaler ADC before 13.1-64.39
- NetScaler ADC before 14.1-73.58 FIPS
- NetScaler ADC before 13.1-37.293 FIPs and NDcPP
- NetScaler Gateway before 14.1-73.57
- NetScaler Gateway before 13.1-64.39
Official advisory · high-confidence parse· fetched ·verify at source
End-of-life dates for NetScaler ADC
More NetScaler (Citrix) advisories
CVE-2026-120867Nov 13, 2026Memory overflow in SSL/TLS/DTLSCVE-2026-120866Nov 13, 2026Memory overflow / improper handling in BGP dynamic routingCVE-2026-120865Nov 13, 2026Memory overflow in HTTP/3 (QUIC)CVE-2026-120864Nov 13, 2026Memory overflow in ICA proxyCVE-2026-120863Nov 13, 2026Memory overflow in the management planeCVE-2026-120861Nov 13, 2026Memory overflow / improper handling in GSLB and geolocation
NetScaler (Citrix) advisories, November 2026All NetScaler (Citrix) advisories
Get an email when NetScaler ADC publishes the next one.
See NetScaler ADC's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.