Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

Citrix patches 28 NetScaler memory flaws, including unauthenticated CVSS 9.3

Original title: 2026-020: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

CERT-EU Advisories ()1 min read
Read at cert.europa.eu
Part of a story covered by 2 sourcesCitrix patches critical NetScaler flaws; no exploitation reportedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CVE-2026-120868 affects every ADC and Gateway deployment, including the default configuration; Citrix reports no exploitation.

On November 12, 2026, Cloud Software Group published bulletins for 28 memory flaws in Citrix NetScaler ADC and NetScaler Gateway. CVE-2026-120868 (CVSS 9.3) is a memory overflow in core packet processing that needs no special feature or authentication and affects all deployments. CVE-2026-107412 (CVSS 9.5) covers unauthenticated memory overflows on Gateway or AAA virtual servers. Citrix reports no exploitation and no confirmed public proof of concept. CERT-EU urges upgrades, starting with internet-facing Gateway and AAA appliances.

Unconfirmed: Citrix reports no exploitation and no confirmed public proof of concept.

Key facts
  • Affected releases are 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39.
  • FIPS builds before 14.1-73.58 FIPS and FIPS/NDcPP before 13.1-37.293 are also affected.
  • Other flaws depend on features such as SAML, LDAP, HTTP/3, BGP and the Application Firewall.
  • Ten flaws are scored high for confidentiality, integrity and availability, but the vendor cites denial of service or unpredictable behaviour.
Security assessment · AI, from the articleNo known exploitation

Impact: Unauthenticated memory overflow; denial of service or unpredictable behaviour

ProductAffectedFixed in
Citrix NetScaler ADC and NetScaler Gateway14.1 before 14.1-73.5714.1-73.57
Citrix NetScaler ADC and NetScaler Gateway13.1 before 13.1-64.3913.1-64.39
Citrix NetScaler ADC FIPSbefore 14.1-73.58 FIPS14.1-73.58 FIPS
Citrix NetScaler ADC FIPS and NDcPPbefore 13.1-37.29313.1-37.293
What to do
  1. 1.Upgrade customer-managed NetScaler ADC and Gateway appliances to the fixed releases.
  2. 2.Prioritize internet-facing Gateway and AAA appliances.
Analyze CVE-2026-120868 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-120868CVE-2026-107412
Tags
netscalercitrixmemory-overflowdenial-of-serviceadcgateway
Vendors
CitrixCloud Software Group
Products
NetScaler ADCNetScaler Gateway
Organizations
CERT-EU

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107412
———
CVE-2026-120868
Memory overflow in NetScaler ADC and Gateway packet processing
9.3—

From the original article

1 min read at cert.europa.eu

On 12 November 2026, the Cloud Software Group published security bulletins for its Citrix products addressing 28 memory flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of these vulnerabilities, CVE-2026-120868, affects every deployment, including those using the default configuration. The vendor bulletin describes the impact as unpredictable behaviour and denial of service.

CERT-EU Advisories

cert.europa.eu

Read the full article at CERT-EU Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.