Citrix NetScaler ADC and Gateway: 28 flaws fixed on 2026-11-12, among them CVE-2026-120868 (CVSS 4.0 9.3) in packet processing on every deployment in default configuration, plus an unauthenticated NetScaler Console authentication bypass (CVE-2026-120869); no exploitation reported
NetScaler: 28 flaws fixed, one reaches every default ADC and Gateway; update to 14.1-73.57 or 13.1-64.39
Defender actions
- Upgrade every customer-managed NetScaler ADC and Gateway to 14.1-73.57, 13.1-64.39 (14.1-73.58 FIPS; 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP) and the NetScaler Console to 14.1-74.34, internet-facing Gateway and AAA appliances first, because CVE-2026-120868 affects every unpatched appliance in default configuration and neither bulletin offers a workaround; keep the management address (NSIP) and the Console IP off networks that untrusted hosts can reach.
Analysis
Cloud Software Group's bulletin CTX697305 of 2026-11-12 fixes 28 flaws in customer-managed NetScaler ADC and NetScaler Gateway (Cloud Software Group, 2026-11-12). The bulletin describes the impact as unpredictable or erroneous behaviour or denial of service, while its CVSS 4.0 vectors score confidentiality, integrity and availability impact High on ten rows, and no source says that code execution is possible (CERT-EU, 2026-11-12). The row that applies everywhere is CVE-2026-120868 (9.3), a memory overflow in packet processing with the precondition "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)" and no authentication or user interaction (Cloud Software Group, 2026-11-12). CVE-2026-107412 (9.5) covers several overflows on an appliance configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or an AAA virtual server, which CERT-EU, citing the vendor, says can be reached without authentication (CERT-EU, 2026-11-12); further rows at 9.3 or 8.7 each depend on one configured feature, such as an SMPP, DNS-over-HTTPS or PUSH virtual server or a SAML, WebAuth, email OTP, certificate or LDAP authentication action, and CVE-2026-120863 needs only a path from an untrusted host to the management address NSIP or NSIP6 (Cloud Software Group, 2026-11-12). Bulletin CTX697320 fixes CVE-2026-120869, an unauthenticated authentication bypass on the NetScaler Console, scored 9.4 with an adjacent vector in the bulletin (Cloud Software Group, 2026-11-12) and 9.3 with a network vector in ENISA's record (ENISA EUVD, 2026-11-12).
The fixed builds are 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 for 13.1-FIPS and 13.1-NDcPP (Cloud Software Group, 2026-11-12), and 14.1-74.34 for the Console (Cloud Software Group, 2026-11-12); Secure Private Access Hybrid deployments must upgrade their NetScaler instances (Cloud Software Group, 2026-11-12). Neither bulletin states an exploitation status or a workaround. CERT-EU writes that Citrix reports no exploitation and no confirmed public proof of concept (CERT-EU, 2026-11-12), NCSC Switzerland lists the exploitation status as unknown (NCSC Switzerland, 2026-11-12), and none of the CVEs is in CISA's catalog. heise reports that Citrix will publish NetScaler security fixes monthly on a fixed date close to Patch Tuesday from now on, with out-of-cycle updates for urgent cases such as active exploitation (heise, 2026-11-12).
Cited evidence
All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
Ten of the flaws are scored as having a high impact on confidentiality, integrity and availability. However, the vendor bulletin describes their impact only as unpredictable behaviour or denial of service
Internet-facing Gateway and AAA appliances should be upgraded first.
Sources6
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.