External risk intelligence

Citrix NetScaler ICA Proxy Memory Overflow Denial of Service.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120864

The vulnerability affects the ICA proxy component of Citrix NetScaler ADC and Gateway. These products are specifically designed as internet-facing gateways and remote access solutions, making them public-facing by design in normal deployment scenarios.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory overflow vulnerability has been identified in the ICA proxy component of Citrix NetScaler ADC and Gateway. This issue could lead to unpredictable behavior or service disruptions, impacting the availability of remote access and application delivery services. The primary concern is to confirm if these specific systems are in use and, if so, assess their exposure.

A technical flaw could disrupt services.
Affects internet-facing remote access systems.
Confirm relevance and exposure of systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable ICA proxy in Citrix NetScaler products over the network without needing any special access or user interaction. This memory overflow flaw could then lead to unpredictable behavior or a denial of service.

No special access required.
Triggered through the network.
Causes denial of service.

Live Threat

Current exploitation, exposure, and threat context

A memory overflow in the ICA proxy component could lead to unpredictable system behavior or denial of service for users accessing Citrix NetScaler ADC and Citrix NetScaler Gateway. This exposure is possible when the ICA proxy is actively processing connections.

Unpredictable service behavior or DoS.
Via ICA proxy processing.
Service disruption for remote access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical memory overflow vulnerability in Citrix NetScaler's ICA proxy impacts the availability and integrity of remote access services, likely managed by infrastructure, network, or platform teams. The immediate first step is to identify all deployed NetScaler instances, determine their external reachability and business criticality, and locate the accountable system owner before planning remediation during a maintenance window.

Infrastructure or platform teams should own the issue.
Verify external reachability and business criticality.
Plan remediation during a scheduled maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Citrix NetScaler ADC and Gateway?

These are networking devices used to deliver applications and manage traffic. They often act as gateways to provide secure remote access to internal corporate resources and virtual desktops, functioning as an entry point for users connecting from outside the organization.

How does this memory overflow work in CVE-2026-120864?

This is a memory overflow weakness where the ICA proxy component fails to properly manage data in system memory. When the proxy receives certain network traffic, this flaw can disrupt how the software operates, potentially causing the service to crash or behave unpredictably, resulting in a denial of service.

What triggers this ICA proxy vulnerability?

The issue is triggered when the ICA proxy processes incoming network connections. An attacker does not need prior authentication or specific user interaction to initiate the trigger. Notably, the vulnerability is only relevant when the ICA proxy functionality is actively handling traffic; it does not manifest if this feature is disabled or not in use.

Why is this CVE significant according to Halo Surface Signal?

Halo Surface Signal highlights this as a critical concern because Citrix NetScaler products are engineered to be internet-facing gateways. Since their primary purpose is to provide remote access from the internet to internal networks, these systems are inherently exposed to external network traffic, increasing the likelihood of reaching the vulnerable component.

What should I do if I use these NetScaler products?

Your first step is to create a complete inventory of all deployed NetScaler instances in your environment. Once identified, work with the system owners to determine which devices are reachable from the internet and evaluate their business criticality. Use this information to coordinate with your infrastructure or platform teams to plan for necessary updates during a scheduled maintenance window.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.