Citrix patches 28 NetScaler flaws, one critical on default installs
CVE-2026-120868, a CVSS 9.3 memory overflow, needs no login or special feature and can crash any unpatched appliance.
76
Vulnerability1 · 1 read
CVE-2026-111338
Auth material written to logs in Citrix NetScaler ADC and Gateway
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Citrix NetScaler ADC and NetScaler Gateway write sensitive authentication material into a log file. A local attacker with low privileges can trigger this with user interaction. The material can be read from the log, exposing credentials and supporting further compromise of the affected appliance.
What to do: Apply Citrix's update for CVE-2026-111338. No workaround is stated.
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | — |
| Citrix NetScaler Gateway | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesCitrix patches 28 NetScaler flaws, nine of them critical
A separate NetScaler Console bug, CVE-2026-120869, scores 9.4 and allows unauthenticated access to restricted resources.
74