I’M UNDER A CYBER ATTACK

Alert

Logo de Citrix

Alert 2026-163 Critical flaws in Citrix NetScaler ADC, Gateway and Console

Affected product(s): 

ProductAffected versionsFixed version
NetScaler ADC and NetScaler Gateway 14.1Earlier than 14.1-73.5714.1-73.57 and later
NetScaler ADC and NetScaler Gateway 13.1Earlier than 13.1-64.3913.1-64.39 and later 13.1
NetScaler ADC 14.1-FIPSEarlier than 14.1-73.58 FIPS14.1-73.58 FIPS and later 14.1-FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPPEarlier than 13.1-37.29313.1-37.293 and later 13.1-FIPS and 13.1-NDcPP
NetScaler Console 14.1Earlier than 14.1-74.3414.1-74.34 and later

The ADC and Gateway advisory (CTX697305) applies to customer-managed installations, including NetScaler instances in Secure Private Access Hybrid. The vendor updates the cloud services it manages, and Adaptive Authentication, on its own. NetScaler Console is a separate product, covered in bulletin CTX697320. Branches 12.1 and 13.0 are not listed in today’s advisory; they no longer receive patches and should be moved to a supported branch.

Description

Twenty-eight vulnerabilities have been published in Citrix NetScaler ADC and NetScaler Gateway, in bulletin CTX697305 of Nov 12, 2026, nine of them rated critical by the vendor. The headline issue is CVE-2026-120868, CVSS 4.0 9.3, critical, which affects all installations, including the default configuration: no additional feature is required. The highest score is CVE-2026-107412, CVSS 4.0 9.5, critical, on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. On the same day, in bulletin CTX697320, the vendor published CVE-2026-120869 in NetScaler Console, CVSS 4.0 9.3, critical. The scores given are the vendor’s CVSS 4.0 ratings. The vendor does not claim remote code execution: it describes unpredictable or incorrect behavior, or a denial of service.

CVECVSS 4.0What it isPrecondition
CVE-2026-1074129.5, criticalSeveral memory overflows; unpredictable behavior or DoSGateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA
CVE-2026-1208689.3, criticalMemory overflow in packet processing; same impactAll ADC and Gateway installations (default configuration)
CVE-2026-1074079.3, criticalOverflow in SMPP trafficSMPP-type LB or CS virtual server
CVE-2026-1074089.3, criticalMemory corruption in DNS or DNS-over-HTTPSDNS load balancing and recursive DNS resolution
CVE-2026-1074099.3, criticalMemory corruption in DNS-over-HTTPS (double free)DNS-over-HTTPS (DoH) load balancing
CVE-2026-1074109.3, criticalOverflow in NetScaler PushPUSH-type LB virtual server
CVE-2026-1074159.3, criticalOverflow in Email OTP authenticationEmail Action configured
CVE-2026-1113449.3, criticalOverflow in Endpoint Analysis (EPA/EPAS)VPN or AAA virtual server with Endpoint Analysis
CVE-2026-1208649.3, criticalOverflow in ICA proxyVPN Gateway, AAA, or HDX-type CR virtual server

The rest of the twenty-eight are also, for the most part, memory issues tied to specific features, with the same kind of impact described by the vendor, and rated high or medium. Among those identified are: RTSP ALG (CVE-2026-107411); SAML (CVE-2026-107413); WebAuth (CVE-2026-107414); KBA (CVE-2026-111340); client-certificate authentication (CVE-2026-111341); LDAP (CVE-2026-111342); authentication request (CVE-2026-111343); Base64 decoding in advanced policy expressions or Application Firewall (CVE-2026-111347); and SSL/TLS/DTLS in scenarios with an ECH profile, Intel QAT Coleto platforms with ECH, or a SafeNet HSM key (CVE-2026-120867). CVE-2026-111348, rated medium, is local: sensitive authentication material can be written to /var/log/httperror.log, and local read access is required on a system where a logout has occurred; it is not a remote exposure.

Other issues in the same bulletin, described by function without forcing an identifier when it was not matched in this review, affect request handling on the data path, HTTP/2, Application Firewall decompression or inspection, load balancing of Diameter, SIP over TCP, MQTT or RADIUS, GSLB and geolocation, SIP ALG or DNS response-section logging, HTTP/3 (QUIC), BGP when a neighbor is configured without TCP-MD5 authentication, and the management plane, which requires reaching the NSIP or NSIP6 from an untrusted host.

On NetScaler Console, CVE-2026-120869, CVSS 4.0 9.3, critical, allows an unauthenticated attacker to bypass authentication controls and access restricted resources on the appliance. It is fixed in 14.1-74.34.

The vendor reports no knowledge of exploitation of these vulnerabilities. No public proof of concept was identified. This product line has been exploited quickly in the past, as covered in Alert 2026-110 and Alert 2026-136. The builds that closed those alerts are not sufficient against this batch: another update is required.

Mitigation

The vendor did not publish a workaround. The only fix it indicates is to update. Inventory NetScaler ADC, Gateway and Console appliances, record the exact branch and build, and prioritize internet-exposed devices configured as a Gateway or AAA, without excluding the rest: CVE-2026-120868 reaches all installations, including the default configuration. Checking for SMPP, DoH, Push, Email OTP, EPA or ICA proxy helps size the other critical CVEs, but it does not remove the need to patch.

As a hardening practice — not as an official mitigation — the management interface (NSIP or NSIP6) and NetScaler Console should not be exposed to the Internet, and access should be limited to trusted administration hosts. One of the memory issues in the ADC and Gateway bulletin requires reaching that management address.

These measures do not replace the update. The patch does not undo a prior compromise.

Detection

The vendor did not publish indicators of compromise.

Solution

The solution is to update each product to the fixed build of its branch, or later. The builds from alerts 2026-110 and 2026-136 (14.1-73.37 and 13.1-64.23, and the equivalent FIPS builds from that bulletin) and those from alert 2026-117 (14.1-73.49 and 13.1-64.32) are not sufficient against this batch. Prioritize Gateways and AAA virtual servers exposed to the Internet, without leaving the rest unpatched, because CVE-2026-120868 affects the default configuration. In Secure Private Access Hybrid, customer-managed NetScaler instances must be updated. The vendor updates the cloud services it manages, and Adaptive Authentication, on its own. Branches 12.1 and 13.0 do not receive patches; they should be moved to a supported, already fixed branch.

Product / branchFix
NetScaler ADC and Gateway 14.114.1-73.57 or later
NetScaler ADC and Gateway 13.113.1-64.39 or later 13.1
NetScaler ADC 14.1-FIPS14.1-73.58 FIPS or later 14.1-FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP13.1-37.293 or later 13.1-FIPS and 13.1-NDcPP

For information on how to update, visit the following link:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305

NetScaler Console

On NetScaler Console, the solution is to update to 14.1-74.34 or later. The management console should not be left reachable from the Internet; that restriction does not replace the patch.

For information on how to update, visit the following link:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320

Additional information: