CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Citrix NetScaler ADC and Gateway: 28 memory-safety flaws fixed on 2026-11-12, among them CVE-2026-120868 (CVSS 4.0 9.3) in packet processing

cve · CVE-2026-111335

Coverage
1
first 2026-11-13 → last 2026-11-13
Latest activity
2026-11-13
NetScaler: 28 flaws fixed, one reaches every default ADC and Gateway; update to 14.1-73.57 or 13.1-64.39
Peak priority
high
1 high
Targets
·
no sector or region stated
Sources cited
6
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-111335, newest first. Check the date before acting on an older one.

  • Upgrade every customer-managed NetScaler ADC and Gateway to 14.1-73.57, 13.1-64.39 (14.1-73.58 FIPS; 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP) and the NetScaler Console to 14.1-74.34, internet-facing Gateway and AAA appliances first, because CVE-2026-120868 affects every unpatched appliance in default configuration and neither bulletin offers a workaround; keep the management address (NSIP) and the Console IP off networks that untrusted hosts can reach.
    2026-11-13CVE-2026-120868 +28

Defender insights

What each entry about CVE-2026-111335 tells a defender to do, newest first.

2026-11-13HIGHNetScaler: 28 flaws fixed, one reaches every default ADC and Gateway; update to 14.1-73.57 or 13.1-64.39

Exposure · detection

Story timeline

  1. 2026-11-13Citrix NetScaler ADC and Gateway: 28 flaws fixed on 2026-11-12, among them CVE-2026-120868 (CVSS 4.0 9.3) in packet processing on every deployment in default configuration, plus an unauthenticated NetScaler Console authentication bypass (CVE-2026-120869); no exploitation reported
    trending-vulnerabilitiesNetScaler: 28 flaws fixed, one reaches every default ADC and Gateway; update to 14.1-73.57 or 13.1-64.39

Hunting pivots

Affected products
Citrix NetScaler ADCCitrix NetScaler ConsoleCitrix NetScaler Gateway
Tags
default-configdospatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ImpactEndpoint Denial of Service: Application or System Exploitation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-13/citrix-netscaler-adc-gateway-ctx697305-28-memory-flaws · ATT&CK page ↗

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-11-13/citrix-netscaler-adc-gateway-ctx697305-28-memory-flaws · ATT&CK page ↗

Entries about Citrix NetScaler ADC and Gateway: 28 memory-safety flaws fixed on 2026-11-12, among them CVE-2026-120868 (CVSS 4.0 9.3) in packet processing (1)

2026-11-13 · view entry permalink →

HIGHCVE-2026-120868 +28NATOA2

Citrix NetScaler ADC and Gateway: 28 flaws fixed on 2026-11-12, among them CVE-2026-120868 (CVSS 4.0 9.3) in packet processing on every deployment in default configuration, plus an unauthenticated NetScaler Console authentication bypass (CVE-2026-120869); no exploitation reported

Cloud Software Group's bulletin CTX697305 of 2026-11-12 fixes 28 flaws in customer-managed NetScaler ADC and NetScaler Gateway (Cloud Software Group, 2026-11-12). The bulletin describes the impact as unpredictable or erroneous behaviour or denial of service, while its CVSS 4.0 vectors score confidentiality, integrity and availability impact High on ten rows, and no source says that code execution is possible (CERT-EU, 2026-11-12). The row that applies everywhere is CVE-2026-120868 (9.3), a memory overflow in packet processing with the precondition "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)" and no authentication or user interaction (Cloud Software Group, 2026-11-12). CVE-2026-107412 (9.5) covers several overflows on an appliance configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or an AAA virtual server, which CERT-EU, citing the vendor, says can be reached without authentication (CERT-EU, 2026-11-12); further rows at 9.3 or 8.7 each depend on one configured feature, such as an SMPP, DNS-over-HTTPS or PUSH virtual server or a SAML, WebAuth, email OTP, certificate or LDAP authentication action, and CVE-2026-120863 needs only a path from an untrusted host to the management address NSIP or NSIP6 (Cloud Software Group, 2026-11-12). Bulletin CTX697320 fixes CVE-2026-120869, an unauthenticated authentication bypass on the NetScaler Console, scored 9.4 with an adjacent vector in the bulletin (Cloud Software Group, 2026-11-12) and 9.3 with a network vector in ENISA's record (ENISA EUVD, 2026-11-12).

The fixed builds are 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP (Cloud Software Group, 2026-11-12), and 14.1-74.34 for the Console (Cloud Software Group, 2026-11-12); Secure Private Access Hybrid deployments must upgrade their NetScaler instances (Cloud Software Group, 2026-11-12). Neither bulletin states an exploitation status or a workaround. CERT-EU writes that Citrix reports no exploitation and no confirmed public proof of concept (CERT-EU, 2026-11-12), NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and none of the CVEs is in CISA's catalog. heise reports that Citrix will publish NetScaler security fixes monthly on a fixed date close to Patch Tuesday from now on, with out-of-cycle updates for urgent cases such as active exploitation (heise, 2026-11-12).

All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)

Cloud Software Group (CTX697305) 2026-11-12

Ten of the flaws are scored as having a high impact on confidentiality, integrity and availability. However, the vendor bulletin describes their impact only as unpredictable behaviour or denial of service

Internet-facing Gateway and AAA appliances should be upgraded first.

CERT-EU (advisory 2026-020) 2026-11-12

Builds on: NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management…

vulnerability13 Nov 04:00Zmulti-sourceOpen finding →
Sources: Cloud Software Group (CTX697305) · Cloud Software Group (CTX697320) · CERT-EU (advisory 2026-020) · NCSC Switzerland (Cyber Security Hub post 13175) · ENISA EUVD (EUVD-2026-124482) · heise online

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • support.citrix.com2 (33%)
  • cert.europa.eu1 (17%)
  • euvdservices.enisa.europa.eu1 (17%)
  • heise.de1 (17%)
  • security-hub.ncsc.admin.ch1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)