External risk intelligence

NetScaler ADC and Gateway Memory Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120868

NetScaler ADC and NetScaler Gateway are enterprise-grade network appliances designed specifically to act as internet-facing gateways, load balancers, and VPN entry points. These products are intended to sit at the network edge to manage, secure, and terminate external traffic, making them public-facing by design in their standard, intended deployments.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A memory overflow vulnerability in packet processing within NetScaler ADC and NetScaler Gateway could lead to unpredictable system behavior or denial of service.

Issue: Flaw in handling network data may cause disruptions.
Why remember: Critical network appliances are affected.
Executive takeaway: Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending specially crafted network packets to an exposed NetScaler appliance. Because the vulnerability exists in the packet processing functionality, an unauthenticated attacker with network access can trigger it. Successfully triggering this vulnerability could lead to unpredictable behavior, system errors, or a complete denial of service.

No authentication or privileges needed.
Triggered by processing network packets.
Results in denial of service.

Live Threat

Current exploitation, exposure, and threat context

A memory overflow in packet processing could lead to unpredictable system behavior, service disruptions, or denial of service for NetScaler ADC and NetScaler Gateway products. This could occur when the system processes crafted network packets, affecting the availability and stability of the network services these appliances manage.

Affects appliance availability and stability.
Occurs via crafted network packet processing.
Could result in service disruption or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects NetScaler ADC and NetScaler Gateway, which are typically managed by infrastructure, platform, and network/security teams due to their role in traffic processing and network access. The immediate first step is to identify all instances of these products, assess their exposure and criticality, and then locate the accountable owners to plan remediation.

Infrastructure or Platform Teams own remediation.
Verify external exposure and criticality first.
Coordinate with NetScaler vendor for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetScaler ADC and NetScaler Gateway?

NetScaler ADC and NetScaler Gateway are specialized networking appliances. Organizations use them as load balancers, traffic managers, and secure VPN entry points. Because they sit at the network edge, they are essential for routing and securing connections between the internet and internal company resources.

How does the memory overflow in CVE-2026-120868 work?

This vulnerability is a memory overflow flaw occurring during the packet processing stage. In plain terms, the software fails to correctly handle the volume or structure of incoming data, which can overwhelm its memory. This leads to instability, system errors, or a complete crash, effectively stopping the appliance from performing its intended tasks.

Can any network traffic trigger this vulnerability?

No. The flaw is triggered specifically when the system attempts to process specially crafted network packets. Normal, valid traffic flows are not what causes the system to fail; instead, the bug relies on uniquely manipulated data designed to exploit the way the software handles memory during packet inspection.

How do I know if my appliance is at risk?

According to Halo Surface Signal, NetScaler ADC and NetScaler Gateway are typically deployed as internet-facing gateways. This makes them highly visible to external traffic by design. If your appliance is positioned to accept connections directly from the internet, it is considered exposed to this potential threat.

What is the first step to address CVE-2026-120868?

Begin by creating a comprehensive inventory of all NetScaler ADC and Gateway instances in your environment. Once you have identified these assets, determine their specific network placement and criticality to the business. After verifying your inventory, contact your vendor to identify available updates and coordinate with your infrastructure team to plan and implement the necessary fixes.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.