Citrix says the flaw can cause unpredictable or erroneous behavior or denial of service.Citrix specifies a reachability condition: an attacker on an untrusted host must be able to reach the appliance’s NSIP or NSIP6 address. That condition determines exposure to this CVE; the fixed software build determines whether the flaw has been patched.
What it allows
How Can CVE-2026-120863 Disrupt the Management Plane?
Citrix identifies a management plane memory overflow and classifies it as CWE-119. Its bulletin describes possible erroneous behavior or denial of service, but does not document a more detailed attack chain for this CVE.
The stated path requires an untrusted host to reach the NetScaler NSIP or NSIP6 address. Map which networks can reach each management address, including routes from less trusted segments. As defensive guidance, restrict that reachability to authorized administration paths while arranging the vendor update.
This access check concerns the management address, not merely an exposed application virtual server. A vulnerability intelligence platform can help teams record the CVE, affected builds, reachability decision, and patch verification together.
Citrix scores this CVE 8.7 High under CVSS 4.0, with high availability impact and no vulnerable-system confidentiality or integrity impact in its vector. These scoring fields describe assessed impact; they do not establish an observed incident.
Who is affected
Which NetScaler Builds Does CVE-2026-120863 Affect?
Citrix lists NetScaler ADC and Gateway 14.1 before 14.1-73.57, and 13.1 before 13.1-64.39. For NetScaler ADC, it lists 14.1-FIPS before 14.1-73.58 FIPS, plus 13.1-FIPS or 13.1-NDcPP before 13.1-37.293.
For this CVE, those affected builds also require the NSIP or NSIP6 reachability condition described by Citrix. Inventory customer-managed appliances by full running build and management-address reachability. Use the vulnerability management guide to track evidence through remediation.
Citrix says Secure Private Access Hybrid deployments using affected NetScaler instances also require those instances to be upgraded. The bulletin applies to customer-managed NetScaler ADC and Gateway. Citrix says it updates Citrix-managed cloud services and managed Adaptive Authentication itself.
Citrix gives fixed thresholds for supported branches but no inclusive starting build for a machine-readable range. Compare the installed branch and complete build string manually. The separate NetScaler packet-processing overflow has a different precondition in the same bulletin.
Timeline
- 2026-11-12
Citrix initially published security bulletin CTX697305.
- 2026-11-13
NVD published the CVE-2026-120863 record.
What to do
-
Check management-address reachability
Identify every customer-managed NetScaler NSIP and NSIP6 address. Determine whether an untrusted host can reach either address, including through less trusted routed networks. Prioritize reachable appliances on affected builds.
-
Install the fixed build for each branch
Upgrade ADC and Gateway 14.1 to 14.1-73.57 or later, and 13.1 to 13.1-64.39 or later. Upgrade ADC 14.1-FIPS to 14.1-73.58 FIPS or later, and ADC 13.1-FIPS or 13.1-NDcPP to 13.1-37.293 or later.
-
Verify the running build and service health
After maintenance, record the full running build on each appliance, including NetScaler instances in Secure Private Access Hybrid. As defensive guidance, verify management access from authorized networks and investigate unexpected restarts or management-service errors.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-120863?
It is a management plane memory overflow in Citrix NetScaler ADC and Gateway. Citrix says it can cause erroneous behavior or denial of service.
When is a NetScaler appliance exposed to this CVE?
Citrix says an attacker on an untrusted host must be able to reach the appliance’s NSIP or NSIP6 address. Check this reachability alongside the installed build.
Which builds fix CVE-2026-120863?
Citrix lists 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, and 13.1-37.293 for their respective supported branches. Verify the full running build after updating.
What does the Citrix severity score mean?
Citrix rates the CVE 8.7 High under CVSS 4.0. Its vector identifies high availability impact without vulnerable-system confidentiality or integrity impact.
