Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

The vulnerabilities affect NetScaler ADC and NetScaler Gateway, with the most severe flaws carrying a CVSS score of 9.5. These memory corruption and overflow issues could cause unpredictable behavior or a denial-of-service condition in various traffic types.

The affected components include Packet Processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP authentication, Endpoint Analysis, and the ICA proxy. The flaws impact deployments configured for load balancing, content switching, VPN virtual servers, and AAA virtual servers.

Citrix has released patches for NetScaler ADC and NetScaler Gateway in versions 14.1-73.57 and later, 13.1-64.39 and later for the 13.1 branch, and specific updates for FIPS and NDcPP configurations. The company stated it is not aware of any active exploits for these vulnerabilities.

Separate fixes were issued for NetScaler Console and the Secure Access Client for Windows and Linux. The patches address an improper authentication vulnerability in NetScaler Console and improper privilege management issues in the client software.

Citrix integrated artificial intelligence into its code analysis process to detect and resolve the vulnerabilities. The company urged customers to apply the updates to enhance the security posture of their NetScaler deployments.

Console and Client Updates

The NetScaler Console update, version 14.1-74.34 and later, addresses a critical authentication bypass. This flaw could allow an unauthenticated attacker to access restricted resources on the appliance.

The Secure Access Client for Windows and Linux received fixes for improper privilege management. The Windows update, version 26.11.1.6 and later, allows a low-privileged user to escalate privileges to SYSTEM. The Linux update, version 26.10.4 and later, prevents a low-privileged user from gaining root privileges.

Citrix emphasized that these updates are designed to harden the products before potential threats could materialize. The company advised all customers to review the release notes and apply the necessary patches immediately.