Citrix has addressed a sweeping set of security flaws—28 in total—in its NetScaler ADC and NetScaler Gateway products, including a dangerous zero-touch vulnerability that affects every default installation. The company released a security bulletin, CTX697305, on November 12, 2026, that marked one of these vulnerabilities, CVE-2026-120868, as Critical. This issue causes memory overflows during packet processing and has a CVSS v4.0 score of 9.3. Unlike other bugs, it requires no special features to be enabled—it hits all unpatched instances of NetScaler.
Security concerns stretch beyond that single flaw. The group of bugs disclosed includes buffer overflows, out-of-bounds writes, and double frees. Many are critical, especially in configurations using Gateway features such as SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or when acting as an AAA virtual server. The most severe of these, CVE-2026-107412, carries a 9.5 rating and applies to those setups.
Scope of Risk: Which Setups Are Affected
The bulletin lays out the impacted versions clearly: customer-managed appliances running NetScaler ADC or Gateway versions earlier than 14.1-73.57 or 13.1-64.39 are vulnerable. Devices using FIPS or NDcPP compliance versions are also exposed unless they’re at patch levels 14.1-73.58 FIPS or 13.1-37.293.
The variety of flaws touches many components—SMPP, DNS/DNS-over-HTTPS, push notifications, email-OTP login, endpoint analysis, ICA proxy, SAML, WebAuth, HTTP/3, MQTT, RADIUS, GSLB, and others. One less severe issue, CVE-2026-111338, logs sensitive authentication info in plain text in /var/log/httperror.log, posing a risk for anyone with read access to that file.
Patching, Remediation, and What To Do Now
Citrix advises customers to upgrade immediately to the corrected firmware versions. There’s no workaround for the default-configuration vulnerability, so speed is critical. Managed cloud services and Adaptive Authentication setups are being updated by Citrix’s teams, but user-installed appliances must be patched manually.
For setups beyond the default configuration, administrators should check if features like “add vpn vserver” or “add authentication samlAction” are active, as those indicate exposure to many of the other flaws. Even so, this doesn’t replace the need to patch—since the default issue is all-encompassing. Securely isolating management interfaces (like NSIP) from untrusted networks is another best practice, especially in light of vulnerabilities that allow access through those channels.
Citrix credited external security researchers at JPMorgan Chase’s XOR team, Capital One Offensive Security, and watchTowr, as well as its internal Product Security Team, with discovering many of these bugs. Some were found using AI-assisted code analysis—showing how machine-aided tools are helping expose deep memory issues across long-standing codebases.
NetScaler has repeatedly appeared in security advisories this year; two zero-day vulnerabilities were patched just last month, one of which was added to the U.S. CISA Known Exploited Vulnerabilities list—demonstrating real threat exploitation even before fixes are fully rolled out.
Why this matters:The discovery of a high-severity vulnerability in default configurations means that no NetScaler installation is safe until it’s patched—a rare and dangerous situation. Organizations using NetScaler must act now, not only to apply fixes but also to reassess network segmentation and ensure management endpoints aren’t exposed. Expect attackers to scan aggressively for these unpatched devices in the coming days. Watch for intrusion attempts, install the patches, and verify your setup against Citrix’s advisory.
