Loading vulnerability…
Knowledge-Based Authentication Memory Overflow in Citrix NetScaler ADC and Gateway
CVE-2026-111340 is a memory overflow vulnerability in the knowledge-based authentication (KBA) functionality of Citrix NetScaler ADC and Citrix NetScaler Gateway. Remote exploitation can cause unpredictable or erroneous appliance behavior or denial of service. The vulnerability is rated High with a CVSS v4.0 score of 8.7; its vector indicates network-based exploitation with low complexity, no required privileges, and no user interaction. The specific vulnerable function and memory-corruption mechanism are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt appliance availability through denial of service or cause unpredictable or erroneous behavior, potentially interrupting remote access and applications delivered through the appliance. The CVSS v4.0 assessment identifies high availability impact and no confidentiality or integrity impact. Code execution, authentication bypass, and data disclosure are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-supported interim workaround is identified. Review the appliance's KBA configuration and the per-vulnerability prerequisites in Citrix bulletin CTX697305 to assess exposure, but do not delay installation of the applicable fixed release.
Patch, then assume compromise.
Apply the applicable fixed release identified in Citrix bulletin CTX697305: NetScaler ADC and Gateway 14.1-73.57 or later in the 14.1 branch; NetScaler ADC and Gateway 13.1-64.39 or later in the 13.1 branch; NetScaler ADC 14.1-FIPS 14.1-73.58 or later in that branch; or NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later in their respective branches. Upgrade affected NetScaler instances used by Secure Private Access Hybrid deployments as well.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.