Executive Summary

On November 12th, 2026, Citrix published security bulletins addressing critical vulnerabilities in NetScaler ADC, NetScaler Gateway, and NetScaler Console. Tracked as CVE-2026-120868, the most broadly applicable flaw is a memory overflow in NetScaler packet processing that affects every NetScaler ADC and Gateway deployment in its default configuration, with no additional feature required. An unauthenticated, remote attacker can use it to cause erroneous behavior or a denial of service. Alongside it, CVE-2026-120869 lets an unauthenticated attacker with network access to a NetScaler Console instance bypass authentication and access restricted resources on the appliance.

These two flaws headline a larger release. Citrix also fixed eight configuration-dependent memory safety flaws covered in this advisory: CVE-2026-107412 and CVE-2026-120864 affect any NetScaler acting as a Gateway or AAA virtual server, while CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107415, and CVE-2026-111344 require specific load balancing, DNS, or authentication features. The flaws share a disclosure and a fixed build rather than chaining together. NetScaler appliances provide internet-facing load balancing, authentication, and remote access, and NetScaler Console centrally manages fleets of those appliances. Earlier NetScaler vulnerabilities disclosed in autumn 2026 were exploited in the wild within days of release, with attackers deploying web shells on compromised appliances.

Although active exploitation has not been reported at the time of writing, memory corruption flaws in NetScaler have historically been weaponized shortly after disclosure as attackers compare patched and unpatched builds. Given the internet exposure of these appliances and the absence of any configuration requirement for CVE-2026-120868, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Product

Affected Versions

Fixed Version

Preconditions

NetScaler ADC and NetScaler Gateway 14.1

before 14.1-73.57

14.1-73.57 and later

None (default configuration)

NetScaler ADC and NetScaler Gateway 13.1

before 13.1-64.39

13.1-64.39 and later

None (default configuration)

NetScaler ADC FIPS 14.1

before 14.1-73.58 FIPS

14.1-73.58 FIPS and later

None (default configuration)

NetScaler ADC FIPS and NDcPP 13.1

before 13.1-37.293

13.1-37.293 and later

None (default configuration)

NetScaler Console 14.1

before 14.1-74.34

14.1-74.34 and later

Network access to the NetScaler Console IP address

Every affected NetScaler ADC and Gateway build is exposed to at least one flaw in its default configuration. Appliances acting as a Gateway or AAA virtual server, or using the specific features described in Technical Details, are exposed to additional flaws. NetScaler ADC and Gateway 12.1 and 13.0 are end of life and receive no fix. Secure Private Access hybrid deployments that use customer-managed NetScaler instances are also affected.

Mitigations / Workarounds

Citrix has not published a workaround for CVE-2026-120868, and because it requires no specific feature, upgrading is the only remediation. A single NetScaler ADC and Gateway upgrade addresses all nine appliance CVEs in this advisory. NetScaler Console requires a separate upgrade for CVE-2026-120869.

Citrix recommends the following order:

  1. 1.

    Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or later, 13.1-64.39 or later, 14.1-73.58 FIPS or later, or 13.1-37.293 FIPS/NDcPP or later, on both nodes of any HA pair.

  2. 2.

    Upgrade NetScaler Console to 14.1-74.34 or later. Console instances still on a build earlier than 14.1-51.x with file-based licensing must obtain a license extension from their Citrix account team before the upgrade will proceed.

  3. 3.

    Restrict access to NetScaler Console and appliance management interfaces to trusted administrative networks until updates are applied.

  4. 4.

    Compare each appliance's ns.conf against the precondition checks Citrix lists in CTX697305 to identify which of the feature-dependent flaws apply.

  5. 5.

    Migrate any appliances still running 12.1 or 13.0 to a supported 14.1 build.

Plan for user impact. Existing ICA sessions are terminated by the upgrade, and users must start new sessions afterward.

Patches

Citrix-managed cloud services, including Secure Private Access, Gateway Service, Adaptive Authentication, and the NetScaler Console Service, have already been updated by the vendor. Citrix has released fixes for customer-managed NetScaler ADC, NetScaler Gateway, and NetScaler Console, and additional information can be found in the official Citrix security bulletins.

Technical Details

Citrix has not released technical details for any of these vulnerabilities, and no public proof of concept exists at the time of writing. Citrix states that its Product Security Team identified several of the flaws through AI-assisted code analysis, and credits researchers from JPMorgan Chase's XOR team and watchTowr for others.

CVE-2026-120868 is a memory overflow in the core packet processing path of NetScaler ADC and Gateway. Its significance lies in reach rather than mechanism. It applies to every deployment regardless of configuration, so any network-reachable appliance is exposed. Citrix rates its potential impact on confidentiality and integrity as high, in addition to availability. That means the vendor does not rule out outcomes beyond a crash, even though the published description names only erroneous behavior and denial of service.

CVE-2026-120869 is an improper authentication flaw in NetScaler Console, the central management platform for NetScaler fleets. Citrix states that an unauthenticated attacker can bypass authentication controls to reach restricted resources on the appliance, but has not described which resources are exposed. The only precondition is network access to the Console IP address. Citrix scores the flaw as reachable from an adjacent network rather than the internet, so exposure depends on where Console sits and who can reach it. Citrix also rates the impact on systems beyond Console itself as high. Because Console holds administrative access to the appliances it manages, a compromised Console instance could provide a path to the wider NetScaler estate. Citrix's Product Security Team discovered this flaw internally.

CVE-2026-107412 and CVE-2026-120864 deserve near-equal priority. Both affect any NetScaler configured as a Gateway or AAA virtual server, which describes most remote access deployments. CVE-2026-107412 covers multiple memory overflows and carries the highest vendor rating in the bulletin, while CVE-2026-120864 is a memory overflow in the ICA proxy. The remaining flaws require a specific feature: Endpoint Analysis (CVE-2026-111344), Email OTP (CVE-2026-107415), SMPP load balancing (CVE-2026-107407), recursive DNS load balancing (CVE-2026-107408), DNS over HTTPS (CVE-2026-107409, a double free), and PUSH load balancing (CVE-2026-107410).

The same bulletin also fixed CVE-2026-120863, a memory overflow in the management plane that Citrix describes as a denial of service flaw. It requires no specific feature, only that an attacker on an untrusted host can reach the appliance's management address (NSIP). This reinforces the need to keep NetScaler management interfaces off untrusted networks.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.

Sources