CVE-2026-120864: Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
- 0.3%
EPSS score, percentile 24.1 of all scored records. A probability estimated by FIRST, not a report of exploitation.
- How severe?
- 9.3 Critical
CVSS v4.0 base score, given by the CNA
- What should I do?
CISA has set no required action, because the vulnerability is not in KEV.
No patch or vendor advisory is listed in the CVE record. Check Citrix's advisories.
- Which versions are affected?
Affected
- before 14.1-73.57
- before 13.1-64.39
- before 14.1-73.58 FIPS
- before 13.1-37.293 FIPs and NDcPP
- before 14.1-73.57
- before 13.1-64.39
Source: CISA KEV 2026.11.13, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway
Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
No patch, vendor advisory or mitigation is listed in the CVE record. Check Citrix's own security advisories for a fix, and compare your version with the affected versions below.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (2 products)
| Status | Versions |
|---|---|
| Affected | before 14.1-73.57 |
| Affected | before 13.1-64.39 |
| Affected | before 14.1-73.58 FIPS |
| Affected | before 13.1-37.293 FIPs and NDcPP |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | before 14.1-73.57 |
| Affected | before 13.1-64.39 |
Versions not listed are: unaffected.
Source: CVE List, as of . About the data.
Timeline
| Date | Event |
|---|---|
| CVE record published |
References
1
Known exploited Citrix vulnerabilities
- CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
- CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability