Citrix patches 12 NetScaler and Secure Access Client flaws
Fixes cover CVSS 9.3–9.5 memory flaws and an unauthenticated NetScaler Console authentication bypass; Citrix knows of no exploits.
76
CVE-2026-120869
Unauthenticated authentication bypass in Citrix NetScaler Console
- CVSS 4.0
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Citrix NetScaler Console lets an unauthenticated remote attacker bypass authentication and reach restricted resources on the appliance. No user interaction is required. Successful use can expose, change, or disrupt those resources with high impact on the appliance itself. Citrix has not listed affected builds or fixed versions.
What to do: Apply Citrix's update for CVE-2026-120869. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Citrix NetScaler Console | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
2 storiesCitrix NetScaler and Secure Access Client builds have security flaws
Canadian Cyber Centre lists pre-update NetScaler and Secure Access Client builds and names three CVEs, without describing impact or exploitation.
52