Citrix has patched 28 security flaws in NetScaler ADC and NetScaler Gateway, and the most urgent of them needs no special configuration to reach. In bulletin CTX697305, published on November 12, 2026, the company fixed CVE-2026-120868, a memory overflow in packet processing rated 9.3 under CVSS v4.0. Unlike most NetScaler flaws, this one affects every ADC and Gateway deployment in its default configuration, and Citrix has published no workaround for it. Upgrading is the only remediation.
The flaw can cause unpredictable behavior or a denial of service, and it requires no login and no user action from anyone who can reach the appliance over the network. Citrix rates its potential impact on confidentiality and integrity as high as well, even though the published description names erroneous behavior and denial of service. For internet-facing load balancers and remote access gateways, that combination removes the triage step administrators usually rely on: there is no feature to check first to learn whether an appliance is exposed.
The highest score in the bulletin belongs to CVE-2026-107412, at 9.5. It covers multiple memory overflows on appliances configured as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server, which describes most remote access deployments. Other 9.3 flaws sit in SMPP traffic handling, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP authentication, Endpoint Analysis, and the ICA proxy. Further flaws at 8.7 touch SAML, LDAP, HTTP/3, and other authentication and protocol paths, and one 6.9 flaw, CVE-2026-111338, writes sensitive login data into the log file /var/log/httperror.log.
Separate bulletins cover the management plane and the clients. CVE-2026-120869, rated 9.4, is an improper authentication flaw in NetScaler Console that can let an unauthenticated attacker with network access to the Console address bypass authentication and reach restricted resources. Because Console centrally manages fleets of appliances, a compromised Console could provide a path to the wider NetScaler estate. The Secure Access Client flaws allow a low-privileged local user to escalate to SYSTEM on Windows, in CVE-2026-118268, rated 8.5, and to root on Linux, in CVE-2026-118269, also rated 8.5.
The fixed builds are NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-37.293 for 13.1-FIPS and NDcPP. NetScaler Console is fixed in 14.1-74.34 and later, the Windows client in 26.11.1.6 and later, and the Linux client in 26.10.4 and later. Appliances still running 12.1 or 13.0 are end of life and receive no fix, so they need to move to a supported build. Both nodes of a high-availability pair should be upgraded, and administrators should expect existing ICA sessions to end during the upgrade.
Citrix said it is not aware of exploits for any of the announced flaws, and no public proof of concept had been reported when analysts published their reviews. The company said several flaws were found through AI-assisted code analysis by its own Product Security Team, and it credited researchers from JPMorgan Chase and watchTowr, among others, for additional findings. Citrix-managed cloud services have already been updated. The caution for customer-managed appliances is historical: earlier NetScaler flaws disclosed this autumn were exploited within days, as attackers compared patched and unpatched builds. A default-configuration flaw on an internet-facing appliance should therefore be patched now, not scheduled for the next routine window.