Citrix patches NetScaler auth bypass and nine critical memory bugs
Citrix fixed 12 NetScaler flaws, including an unauthenticated auth bypass in NetScaler Console (CVE-2026-120869, 9.4) and nine critical ADC/Gateway memory bugs. No exploitation reported yet.
Citrix has released patches for 12 vulnerabilities across NetScaler ADC, NetScaler Gateway, NetScaler Console, and the Secure Access Client. The standout is an unauthenticated authentication bypass in NetScaler Console, CVE-2026-120869 (CVSS 9.4), alongside nine critical memory-handling flaws (9.3–9.5) in ADC and Gateway. Citrix says it is not aware of any exploits for the batch — but NetScaler's track record means internet-facing appliances should be patched on the short clock. Details are in Citrix advisories CTX697305 (ADC/Gateway), CTX697320 (Console), and CTX697280/CTX697281 (Secure Access Client).
Affected versions and CVEs
NetScaler Console — CVE-2026-120869 (9.4): improper authentication lets an unauthenticated attacker reach restricted resources. Fixed in NetScaler Console 14.1-74.34 and later.
NetScaler ADC and Gateway — nine critical memory overflow/corruption bugs, each gated by a specific configuration, per The Hacker News:
- CVE-2026-120868 (9.3) — packet processing, all deployments
- CVE-2026-107412 (9.5) — Gateway or AAA vserver
- CVE-2026-107407 (9.3) — SMPP load-balancing/content-switching vserver
- CVE-2026-107408 / CVE-2026-107409 (9.3) — DNS and DNS-over-HTTPS handling
- CVE-2026-107410 (9.3) — PUSH vserver
- CVE-2026-107415 (9.3) — Email OTP authentication
- CVE-2026-111344 (9.3) — Endpoint Analysis (EPA/EPAS)
- CVE-2026-120864 (9.3) — ICA proxy (HDX)
Fixed in NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, 14.1-FIPS 14.1-73.58 FIPS and later, and 13.1-FIPS / 13.1-NDcPP 13.1-37.293 and later.
Secure Access Client — CVE-2026-118268 (8.5, Windows, low-priv user to SYSTEM; fixed in 26.11.1.6+) and CVE-2026-118269 (8.5, Linux, to root; fixed in 26.10.4+).
Exploitation status
Citrix's security-updates post states the company "is not aware of any exploits for any of the announced vulnerabilities." No public PoC has surfaced and none of the 12 are in CISA's KEV catalog as of publication. That is the window defenders have, not a reason to wait.
Action checklist
- Upgrade NetScaler Console first to 14.1-74.34+ — CVE-2026-120869 is the only unauthenticated, network-reachable bug in the set.
- Patch ADC/Gateway to the fixed builds above. Match your edition (standard, FIPS, NDcPP) to the right fix line.
- Update Secure Access Client on Windows (26.11.1.6+) and Linux (26.10.4+) to close the local-to-SYSTEM/root escalations.
- Don't expose the Console. Keep NetScaler Console on a management network, not the public internet.
- Review which configs apply. The nine ADC/Gateway bugs each require a specific vserver type; the config lines above tell you which deployments are actually reachable.
Context
NetScaler appliances have been among the most aggressively exploited edge devices of the past two years — CitrixBleed and its sequel both went from advisory to mass exploitation in days. An unauthenticated bypass in the management plane (CVE-2026-120869) plus a stack of 9.3+ memory bugs is the familiar shape of the next campaign, even with no exploitation reported today. Patch before the PoC, not after.