Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Citrix patches critical NetScaler flaws; no exploitation reported

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Citrix has issued November 12 fixes for critical NetScaler memory flaws; the vendor reports no exploitation.

On November 12, 2026, Cloud Software Group published bulletins covering 28 memory flaws in Citrix NetScaler ADC and NetScaler Gateway, according to CERT-EU. CVE-2026-120868 (CVSS 9.3) is a memory overflow in core packet processing that requires no special feature or authentication and affects every deployment, including the default configuration. CVE-2026-107412 (CVSS 9.5) covers unauthenticated memory overflows on Gateway or AAA virtual servers. Citrix reports no exploitation and no confirmed public proof of concept. The Canadian Centre for Cyber Security’s AV26-1150 lists the same ADC and Gateway builds plus NetScaler Console and Secure Access Client updates tied to CVE-2026-120869, CVE-2026-118269 and CVE-2026-118268, and tells administrators to apply updates.

Key facts
  • Affected ADC and Gateway releases: 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39.
  • FIPS builds before 14.1-73.58 FIPS and 13.1-37.293 FIPS and NDcPP are affected.
  • CERT-EU urges upgrades first for internet-facing Gateway and AAA appliances.
  • Other flaws depend on SAML, LDAP, HTTP/3, BGP or the Application Firewall.
  • Console before 14.1-74.34 is CVE-2026-120869; Linux client before 26.10.4 and Windows before 26.11.16.
  • Ten flaws score high for confidentiality, integrity and availability; vendor cites denial of service.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 12, 2026Cloud Software Group published NetScaler ADC and Gateway bulletins. · CERT-EU Advisories
  2. Nov 12, 2026Canadian Cyber Centre issued Citrix advisory AV26-1150. · Canadian Centre for Cyber Security

What each outlet adds

beyond the shared facts
  • CERT-EU AdvisoriesNames critical CVEs, CVSS scores, 28 flaws, and no known exploitation or PoC.
  • Canadian Centre for Cyber SecurityAdds Console and Secure Access Client builds and three further CVE IDs.
CVEs
CVE-2026-120868CVE-2026-107412CVE-2026-120869CVE-2026-118269CVE-2026-118268
Vendors
CitrixCloud Software Group
Products
NetScaler ADCNetScaler GatewayNetScaler ADC FIPSNetScaler ConsoleSecure Access Client for LinuxSecure Access Client for Windows
Organizations
CERT-EUCanadian Centre for Cyber Security

Coverage

oldest first · one row per article · UTC
  1. · 9h ago Canadian Centre for Cyber SecurityFirst report

    Citrix NetScaler and Secure Access Client builds have security flaws

    Canadian Cyber Centre lists pre-update NetScaler and Secure Access Client builds and names three CVEs, without describing impact or exploitation.

  2. · 7h ago CERT-EU Advisories

    Citrix patches 28 NetScaler memory flaws, including unauthenticated CVSS 9.3

    CVE-2026-120868 affects every ADC and Gateway deployment, including the default configuration; Citrix reports no exploitation.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-107412
———
CVE-2026-118268
———
CVE-2026-118269
———
CVE-2026-120868
Memory overflow in NetScaler ADC and Gateway packet processing
9.3—
CVE-2026-120869
Unauthenticated authentication bypass in Citrix NetScaler Console
9.3—