Vulnerabilityhigh

Citrix patches 28 NetScaler flaws, one critical on default installs

Original title: Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations

Cyber Security Newsby AbinayaNov 13, 2026 · 14:18 UTC (23h ago)3 min read1

Read at cybersecuritynews.com

AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-120868, a CVSS 9.3 memory overflow, needs no login or special feature and can crash any unpatched appliance.

Cloud Software Group bulletin CTX697305, published November 12, 2026, fixes 28 flaws in customer-managed NetScaler ADC and Gateway. Most are memory bugs that apply only when a matching feature is enabled; the highest score is 9.5 for CVE-2026-107412 on Gateway or AAA setups. No workaround exists. Citrix is updating managed cloud services and Adaptive Authentication, and hybrid Secure Private Access setups also need upgrades.

Unconfirmed: The bulletin does not say whether any of these 28 flaws are being exploited.

Key facts

Affected builds are 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39.
FIPS lines before 14.1-73.58 FIPS and 13.1-37.293 are also affected.
CVE-2026-111338 can write login data into /var/log/httperror.log.
CVE-2026-120863 is reachable through the management address, NSIP.
Citrix credited JPMorgan Chase, Capital One, watchTowr, and its own team.

Security assessment · AI, from the article

Impact: Unauthenticated denial of service or unstable appliance behavior

Product	Affected	Fixed in
Citrix NetScaler ADC and NetScaler Gateway	14.1 before 14.1-73.57; 13.1 before 13.1-64.39; 14.1 FIPS before 14.1-73.58 FIPS; 13.1 FIPS and NDcPP before 13.1-37.293	14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293

What to do

1.Install the fixed builds named in bulletin CTX697305; no workaround is available.
2.Keep NetScaler management addresses (NSIP) off untrusted networks.
3.Search the configuration for bulletin entries to see which feature-specific flaws apply.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1190 Exploit Public-Facing Application

Tags: netscaler citrix memory-corruption denial-of-service adc

Vendors: Citrix
Products: NetScaler ADC NetScaler Gateway
Organizations: Cloud Software Group watchTowr

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-107412 +24 related CVEs CVE-2026-107408 CVE-2026-107409 CVE-2026-107410 CVE-2026-107407 CVE-2026-107415 CVE-2026-111334 CVE-2026-120864 CVE-2026-120868 CVE-2026-107413 CVE-2026-107414 CVE-2026-111337 CVE-2026-111340+12 more	Memory overflow in Citrix NetScaler ADC and Gateway	9.5 group max	—		1d ago
CVE-2026-107411 +2 related CVEs CVE-2026-120861 CVE-2026-120862	Memory overflow in Citrix NetScaler RTSP ALG	8.7	—		1d ago

From the original article

3 min read at cybersecuritynews.com

Citrix has released fixes for 28 security flaws in NetScaler ADC and NetScaler Gateway. One of them, CVE-2026-120868, affects every deployment in its default setup. Cloud Software Group published bulletin CTX697305 on November 12, 2026, and rated it Critical.

Cyber Security News

By Abinaya · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.