Citrix patches 12 NetScaler and Secure Access Client flaws
Original title: Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
Fixes cover CVSS 9.3–9.5 memory flaws and an unauthenticated NetScaler Console authentication bypass; Citrix knows of no exploits.
Citrix released patches for multiple critical flaws in NetScaler ADC, NetScaler Gateway and NetScaler Console that can cause denial of service or authentication bypass. Nine memory overflow or corruption issues, scored 9.3 or 9.5, affect packet processing, SMPP, DNS, Push, Gateway/AAA, Email OTP, Endpoint Analysis and ICA proxy, depending on configuration. CVE-2026-120869 lets an unauthenticated attacker bypass authentication on NetScaler Console. Secure Access Client flaws let a low-privileged user reach SYSTEM on Windows or root on Linux. Citrix said it is not aware of exploits and urged customers to update.
- ADC and Gateway fixes start at 14.1-73.57 and 13.1-64.39.
- 14.1-FIPS is fixed in 14.1-73.58; 13.1-FIPS and 13.1-NDcPP in 13.1-37.293.
- Console authentication bypass CVE-2026-120869 is fixed in 14.1-74.34.
- Windows client is fixed in 26.11.1.6; Linux client in 26.10.4.
- Citrix said AI-assisted code review helped find the issues before attacks.
Impact: Denial of service, authentication bypass, or local privilege escalation
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC and NetScaler Gateway | releases before 14.1-73.57 and 13.1-64.39 | 14.1-73.57 and later; 13.1-64.39 and later of 13.1 |
| Citrix NetScaler ADC FIPS and NDcPP | 14.1-FIPS before 14.1-73.58; 13.1-FIPS and 13.1-NDcPP before 13.1-37.293 | 14.1-73.58 FIPS; 13.1-37.293 |
| Citrix NetScaler Console | before 14.1-74.34 | 14.1-74.34 and later |
| Citrix Secure Access Client for Windows | before 26.11.1.6 | 26.11.1.6 and later |
| Citrix Secure Access Client for Linux | before 26.10.4 | 26.10.4 and later |
- 1.Update NetScaler ADC and Gateway to the fixed 14.1 or 13.1 releases.
- 2.Update NetScaler Console to 14.1-74.34 or later.
- 3.Update Secure Access Client to 26.11.1.6 on Windows or 26.10.4 on Linux.
- CVEs
- CVE-2026-120868CVE-2026-107407CVE-2026-107408CVE-2026-107409CVE-2026-107410CVE-2026-107412CVE-2026-107415CVE-2026-111344CVE-2026-120864CVE-2026-120869CVE-2026-118268CVE-2026-118269
- Vendors
- Citrix
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107407 | — | — | — | ||
| CVE-2026-107408 | — | — | — | ||
| CVE-2026-107409 | — | — | — | ||
| CVE-2026-107410 | — | — | — | ||
| CVE-2026-107412 | — | — | — | ||
| CVE-2026-107415 | — | — | — | ||
| CVE-2026-111344 | Authorization bypass in APITable through 1.14.0-beta | 5.3 | — | ||
| CVE-2026-118268 | — | — | — | ||
| CVE-2026-118269 | — | — | — | ||
| CVE-2026-120864 | — | — | — | ||
| CVE-2026-120868 | Memory overflow in NetScaler ADC and Gateway packet processing | 9.3 | — | ||
| CVE-2026-120869 | Unauthenticated authentication bypass in Citrix NetScaler Console | 9.3 | — |
From the original article
3 min read at thehackernews.com
Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9. 3) - A memory overflow vulnerability in Packet
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.