Citrix Patches 10 Critical NetScaler Vulnerabilities
Citrix on Thursday announced patches for 28 vulnerabilities in NetScaler ADC and Gateway, including nine critical-severity bugs that could lead to denial-of-service conditions.
The critical flaws stem from memory overflow issues in Packet Processing, SMPP traffic, DNS/DoH, NetScaler Push, Email OTP authentication, Endpoint Analysis, and ICA proxy. They are tracked as CVE-2026-120868, CVE-2026-107407 to CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334, and CVE-2026-120864.
Most of the remaining 19 security defects are high-severity weaknesses leading to similar outcomes. Citrix also patched several medium-severity bugs, including CVE-2026-111338, which exposes sensitive authentication material in a log file.
Affected versions
NetScaler ADC and Gateway versions 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later contain the relevant patches.
NetScaler Console flaw
On Thursday, the company also announced patches for a critical-severity flaw in NetScaler Console. Tracked as CVE-2026-120869 (CVSS score of 9.4), it could allow unauthenticated attackers to bypass controls and access restricted resources. The security defect impacts all NetScaler Console 14.1 releases before 14.1-74.34.
Citrix urges customers to update their instances as soon as possible, and details CVE preconditions associated with some of the vulnerabilities.
Threat landscape
Citrix makes no mention of any of these vulnerabilities being exploited in the wild, but vulnerabilities in NetScaler are a frequent target for threat actors.
Related
