November 13, 2026

CVE Watchtower

CVE-2026-111339Citrix NetScaler ADC

NVD

Vulnerability Summary

Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Severity Level
MEDIUM(6.9)
Published Date
Nov 13, 2026
Last Modified
Nov 13, 2026
Exploitation Status
No confirmed exploitation yet
Root Weakness (CWE)
N/A
CVSS v4.0 Base Metrics — Score 6.9 (MEDIUM)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Attack VectorLocal
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionActive
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)Low
Confidentiality (Subsequent System)Low
Integrity (Subsequent System)Low
Availability (Subsequent System)Low

Affected & Patched Versions

Affected Versions
  • Citrix NetScaler ADC < 14.1-73.57
  • Citrix NetScaler ADC < 13.1-64.39
  • Citrix NetScaler ADC < 14.1-73.58 FIPS
  • Citrix NetScaler ADC < 13.1-37.293 FIPs and NDcPP
  • Citrix NetScaler Gateway < 14.1-73.57
  • Citrix NetScaler Gateway < 13.1-64.39
Patched Versions
  • Citrix NetScaler ADC 14.1-73.57
  • Citrix NetScaler ADC 13.1-64.39
  • Citrix NetScaler ADC 14.1-73.58 FIPS
  • Citrix NetScaler ADC 13.1-37.293 FIPs and NDcPP
  • Citrix NetScaler Gateway 14.1-73.57
  • Citrix NetScaler Gateway 13.1-64.39

What to do

Fix it during your normal patch cycle. No exploitation is confirmed yet.

  1. Check whether you run Citrix NetScaler ADC and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Nov 13, 2026Published
  • Nov 13, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Citrix CVEsYou are reading CVE-2026-111339. Get an email when KEV listings, exploits or new CVEs match your stack.
Notify me about Citrix CVEs

More Citrix NetScaler ADC CVEs

All Citrix vulnerabilities →

External References

Data last checked: Nov 13, 2026 08:12 (site time)