CVE-2026-120861: Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Published Nov 13, 2026
·Updated
Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Event History
Nov 13, 2026
CVE Published
via MITRE·07:58 AM
Data Sourced
via MITRE·07:58 AM
Description
Data Sourced
via NVD·08:17 AM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation is network-based, requires low attack complexity, and does not require privileges or user interaction.
2
Which deployments should be prioritized for investigation?
Prioritize Citrix NetScaler deployments using GSLB or geolocation-related functionality, including MEP, static-proximity, or config-sync.
3
What is the expected security impact?
The reported impact includes unpredictable or erroneous behavior and denial of service. The CVSS assessment indicates high impact to availability, with low potential impact to the availability, integrity, and confidentiality of subsequent systems.