Citrix Patches 10 Critical NetScaler Vulnerabilities
Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges customers to update as soon as possible.
Nine critical memory overflow flaws in NetScaler ADC and Gateway
The critical vulnerabilities come from memory overflow issues in several NetScaler components and could lead to unpredictable or erroneous behavior, or denial-of-service (DoS) conditions. The affected components are:
- Packet Processing
- SMPP traffic handling
- DNS and DNS-over-HTTPS (DoH)
- NetScaler Push
- Email OTP authentication
- Endpoint Analysis (EPA/EPAS)
- ICA proxy
The critical flaws are tracked as:
- CVE-2026-120868
- CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410
- CVE-2026-107412
- CVE-2026-107415
- CVE-2026-111334
- CVE-2026-120864
High- and medium-severity flaws
Most of the remaining 19 NetScaler ADC and Gateway vulnerabilities are high-severity weaknesses with similar outcomes. Citrix also fixed several medium-severity bugs, including CVE-2026-111338, which exposes sensitive authentication material in a log file. Some vulnerabilities only apply under specific configurations, and Citrix’s advisory lists the preconditions for each one.
The tenth critical flaw: NetScaler Console (CVE-2026-120869)
On Thursday, Citrix also announced patches for a critical flaw in NetScaler Console, tracked as CVE-2026-120869 (CVSS 9.4). It could let unauthenticated attackers bypass controls and reach restricted resources. All NetScaler Console 14.1 releases before 14.1-74.34 are affected.
Fixed versions
| Product | Fixed version |
|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.57 and later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.39 and later |
| NetScaler ADC 14.1-FIPS | 14.1-73.58 and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1-37.293 and later |
| NetScaler Console 14.1 | 14.1-74.34 and later |
Exploitation status
Citrix does not mention any of these vulnerabilities being exploited in the wild. However, NetScaler appliances are a frequent and high-value target for threat actors. They often sit at the network edge, handle authentication and remote access, and past NetScaler flaws have been widely exploited soon after disclosure. Patch quickly.
Why it matters
NetScaler ADC and Gateway often provide remote access to corporate environments, including VPN, ICA proxy for Citrix Virtual Apps and Desktops, and authentication services. A DoS condition on these appliances could cut off remote access for an entire organization. The log-file exposure (CVE-2026-111338) and the Console bypass (CVE-2026-120869) could give attackers a foothold for broader compromise.
Recommendations
- Update NetScaler ADC and Gateway to the fixed versions listed above as soon as possible.
- Update NetScaler Console to 14.1-74.34 or later, and restrict Console access to trusted management networks.
- Check Citrix’s advisory for the preconditions of each vulnerability, to understand your exposure based on which features are enabled (DNS, DoH, Email OTP, EPA, ICA proxy, NetScaler Push, SMPP).
- Review and protect logs: Given CVE-2026-111338, check who can read NetScaler log files. If sensitive authentication material may have been exposed, consider rotating the affected credentials.
- Watch appliances for unexpected crashes, reboots, or unusual traffic patterns, which could point to exploitation attempts.
- Inventory internet-facing NetScaler instances, including end-of-life versions that may not get patches.
We will update this post if active exploitation is reported.
