CVE-2026-120868

CriticalCVSS 9.3/10Last modified Nov 13, 2026

Description

Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Citrix NetScaler	ADC	< 14.1-73.57; < 13.1-64.39; < 14.1-73.58 FIPS; < 13.1-37.293 FIPs and NDcPP
Citrix NetScaler	Gateway	< 14.1-73.57; < 13.1-64.39

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1208699.3An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance CVE-2026-120879.1Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source CVE-2026-120894.9The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and i CVE-2026-120906.5The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection vi CVE-2026-120915.3IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a CVE-2026-120935.3The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to CVE-2026-1209305.4Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted CVE-2026-1209319.6Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outsi CVE-2026-120945.3The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability che CVE-2026-120957.2The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url CVE-2026-1209527.1An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a CVE-2026-1209534.3A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the drive