Citrix patches 28 NetScaler flaws, nine of them critical
Original title: Citrix Patches 10 Critical NetScaler Vulnerabilities
A separate NetScaler Console bug, CVE-2026-120869, scores 9.4 and allows unauthenticated access to restricted resources.
Citrix released patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical memory-overflow bugs. Those flaws affect packet processing, SMPP, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP, Endpoint Analysis, and the ICA proxy, and can cause erroneous behavior or denial of service. A medium-severity issue, CVE-2026-111338, can expose authentication material in a log file. Citrix also patched critical CVE-2026-120869 in NetScaler Console and did not report in-the-wild exploitation.
Unconfirmed: Citrix does not say whether any of these vulnerabilities have been exploited.
- Fixed ADC and Gateway builds include 14.1-73.57, 13.1-64.39, and 14.1-73.58 FIPS and later.
- FIPS and NDcPP branch 13.1 is fixed in 13.1-37.293 and later.
- Console 14.1 releases before 14.1-74.34 are affected by CVE-2026-120869.
- Citrix says customers should update instances as soon as possible.
Impact: Denial of service, or unauthenticated access to restricted Console resources
| Product | Affected | Fixed in |
|---|---|---|
| Citrix NetScaler ADC and NetScaler Gateway | releases before the stated patched builds | 14.1-73.57 and later; 13.1-64.39 and later; 14.1-73.58 FIPS and later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later |
| Citrix NetScaler Console | all 14.1 releases before 14.1-74.34 | 14.1-74.34 |
- 1.Update NetScaler ADC and Gateway to the patched builds Citrix lists.
- 2.Update NetScaler Console 14.1 to 14.1-74.34 or later.
- 3.Review Citrix’s stated preconditions for the individual flaws.
- CVEs
- CVE-2026-120868CVE-2026-107407CVE-2026-107410CVE-2026-107412CVE-2026-107415CVE-2026-111334CVE-2026-120864CVE-2026-111338CVE-2026-120869
- Vendors
- Citrix
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107412 | Memory overflow in Citrix NetScaler ADC and Gateway | 9.5 group max | — | ||
| CVE-2026-120869 | Unauthenticated authentication bypass in Citrix NetScaler Console | 9.3 | — |
From the original article
1 min read at securityweek.com
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions. The post Citrix Patches 10 Critical NetScaler Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.