Memory Overflow Vulnerability in Citrix NetScaler Products
CVE-2026-120865

8.7HIGH

Key Information:

Vendor: Citrix
Status: Netscaler Adc; Netscaler Gateway
Vendor: CVE Published:; 13 November 2026

What is CVE-2026-120865?

A memory overflow vulnerability in the HTTP/3 (QUIC) protocol has been identified in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw could result in unpredictable application behavior and may lead to Denial of Service (DoS) conditions, impacting the availability and reliability of services provided by these products. Users are advised to review their configurations and apply necessary patches to mitigate potential risks.

Affected Version(s)

NetScaler ADC 0 < 14.1-73.57

NetScaler ADC 0 < 13.1-64.39

NetScaler ADC 0 < 14.1-73.58 FIPS

References

https://support.citrix.com/support-home/kbsearch/article?...

CVSS V4

Score:

8.7

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 13, 2026
Vulnerability Reserved
Nov 3, 2026

CVE-2026-120865 Data

JSON