Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations

Citrix has released fixes for 28 security flaws in NetScaler ADC and NetScaler Gateway. One of them, CVE-2026-120868, affects every deployment in its default setup. Cloud Software Group published bulletin CTX697305 on November 12, 2026, and rated it Critical.

CVE-2026-120868 is a memory overflow in packet processing. It carries a CVSS v4.0 score of 9.3. Most NetScaler bugs need a specific feature turned on. This one does not. No extra setting is needed, so every unpatched appliance is vulnerable.

The bug can cause unpredictable behavior or a denial-of-service. Because the attack needs no login and no user action, anyone who can reach the device over the network can try it.

Almost all of the 28 flaws are memory bugs. They include buffer overflows, out-of-bounds writes, and a double free. Citrix says most can crash the device or make it behave oddly. Each one only matters if the matching feature is in use.

The highest score, 9.5, belongs to CVE-2026-107412. It hits appliances set up as a Gateway, such as SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Several other bugs score 9.3. They sit in areas like SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP login, Endpoint Analysis, and ICA proxy.

Citrix Patches NetScaler Security Vulnerabilities

Many others score 8.7 and touch SAML, WebAuth, LDAP, client-certificate login, HTTP/3, GSLB, Diameter, MQTT and RADIUS handling. A BGP routing flaw scores 7.7, but an attacker would need to be or fake a configured neighbor.

Three flaws score 6.9. One of them, CVE-2026-111338, writes sensitive login data into the log file /var/log/httperror.log, so someone with local read access could see it.

The bulletin covers customer-managed appliances. Versions 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39 are affected. So are 14.1 FIPS before 14.1-73.58 FIPS, and 13.1 FIPS and NDcPP before 13.1-37.293.

Citrix reports that Secure Private Access hybrid setups using NetScaler instances require upgrades, while Cloud Software Group is updating its managed cloud services and Adaptive Authentication; no workaround is available, and customers should install fixed builds immediately.

For the other 27 flaws, admins can search their configuration for the entries Citrix lists, such as add vpn vserver or add authentication samlAction. That shows which bugs apply to their setup. It should not delay patching, since the default-configuration flaw affects everyone.

Citrix thanked researchers from JPMorgan Chase’s XOR team, Capital One Offensive Security, and watchTowr. It also said its own Product Security Team found several of the bugs using advanced AI-assisted code analysis. This suggests AI tools are starting to surface memory bugs in old, large codebases.

NetScaler has been a repeat target this year. Citrix fixed two zero-days in October that attackers were already using, and CISA added one of them to its Known Exploited Vulnerabilities list.

We also covered how exploitation of CitrixBleed 2 led to ransomware. Past NetScaler bugs were attacked quickly after patches came out, so a flaw that needs no setup will draw attention fast.

Admins should upgrade to the fixed builds and check their configuration against the bulletin. They should also keep the management addresses (NSIP) away from untrusted networks, because CVE-2026-120863 can be reached through them. Teams can read the full advisory on the Citrix Security Bulletin page and report problems to [email protected].

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations appeared first on Cyber Security News.