High8.7NetScaler (Citrix)

CVE-2026-120865: Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

This NetScaler advisory covers CVE-2026-120865 in NetScaler ADC and NetScaler Gateway.

Key facts

Vendor rating: High, CVSS 8.7
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L · base score 8.7, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: none. Integrity impact on the vulnerable system: none. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: low. Availability impact on subsequent systems: low.
EPSS: 0.31% chance of exploitation in the next 30 days (24th percentile). FIRST EPSS, Nov 13, 2026.
CISA KEV: Not listed (catalogue checked Nov 15, 2026)
Affected: NetScaler ADC before 14.1-73.57; NetScaler ADC before 13.1-64.39; NetScaler ADC before 14.1-73.58 FIPS and 3 more below
Fixed in: 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 1 more below
Source published: Nov 13, 2026
Listed by VulniPulse: Nov 13, 2026

Compiled by VulniPulse from the linked sources. How records are collected and checked.

NetScaler (Citrix)NetScaler ADCNetScaler Gateway

Affected versions

Official advisory · high-confidence parse· fetched Nov 13, 2026·verify at source

See NetScaler ADC's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.