Citrix NetScaler and Secure Access Client builds have security flaws
Original title: Citrix security advisory (AV26-1150)
Canadian Cyber Centre lists pre-update NetScaler and Secure Access Client builds and names three CVEs, without describing impact or exploitation.
On November 12, 2026, the Canadian Centre for Cyber Security issued AV26-1150 saying Citrix products are affected by vulnerabilities. Named products are NetScaler ADC and NetScaler Gateway, NetScaler ADC FIPS, NetScaler Console, and Secure Access Client for Linux and Windows, each below stated builds. Linked Citrix bulletins cite CVE-2026-120869, CVE-2026-118269 and CVE-2026-118268. The centre tells users and administrators to review the links and apply necessary updates as they become available.
Unconfirmed: The alert does not state flaw impact, severity, or whether any vulnerability is being exploited, and says updates should be applied as they become available.
- NetScaler ADC and Gateway builds before 13.1-64.39 and 14.1-73.57 are listed.
- NetScaler ADC FIPS builds before 14.1-73.58 FIPS and 13.1-37.293 FIPS & NDcPP are listed.
- NetScaler Console before 14.1-74.34 is tied to CVE-2026-120869.
- Secure Access Client for Linux before 26.10.4 is CVE-2026-118269.
- Secure Access Client for Windows before 26.11.16 is CVE-2026-118268.
| Product | Affected |
|---|---|
| Citrix NetScaler ADC and NetScaler Gateway | Prior to 13.1-64.39; prior to 14.1-73.57 |
| Citrix NetScaler ADC FIPS | Prior to 14.1-73.58 FIPS; prior to 13.1-37.293 FIPS & NDcPP |
| Citrix NetScaler Console | Prior to 14.1-74.34 |
| Citrix Secure Access Client for Linux | Prior to 26.10.4 |
| Citrix Secure Access Client for Windows | Prior to 26.11.16 |
- 1.Review the linked Citrix security bulletins and apply necessary updates as they become available.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118268 | — | — | — | ||
| CVE-2026-118269 | — | — | — | ||
| CVE-2026-120869 | Unauthenticated authentication bypass in Citrix NetScaler Console | 9.3 | — |
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1150 Date: November 12, 2026 As of November 12, 2026, Citrix is affected by vulnerabilities in the following products: NetScaler ADC and NetScaler Gateway Prior to 13. 1-64. 39 Prior to 14.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.