CVE-2026-120864Not scored
CVE-2026-120864: Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway
Citrix · NetScaler ADC
Vendor fix available · Affected: Citrix NetScaler ADC · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.3%probability of exploitation in the next 30 days
24th percentile
050100
Higher than 24% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Citrix
- Published
- November 2026
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: The Hacker News, 12 Nov.
Quiet for 2 dayslast report 13 Nov2 articles2 outlets
- Thu 12 Nov, 17:01 UTC. The Hacker News, first report. Citrix patches NetScaler flaws enabling denial of service and bypass.
- Fri 13 Nov, 10:32 UTC. SecurityWeek, its first report on the story. Citrix patches critical flaws in NetScaler products.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 12 Nov 17:01 | The Hacker News | Citrix patches NetScaler flaws enabling denial of service and bypass |
| 13 Nov 10:32 | SecurityWeek | Citrix patches critical flaws in NetScaler products |
- Citrix patches critical flaws in NetScaler productsSecurityWeek · mentions it in passing
- Citrix patches NetScaler flaws enabling denial of service and bypassThe Hacker News · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.