Citrix patched twelve flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client on 12 November 2026. Nine are critical NetScaler ADC and Gateway bugs, and a tenth critical one, CVE-2026-120869, lets an unauthenticated attacker bypass authentication on NetScaler Console. Citrix says it is not aware of exploits for any of them (The Hacker News), but NetScaler has been a repeat target, so treat the patch window as short.
The flaws that matter most
| CVE | CVSS | Affected | Impact | Fixed in |
|---|---|---|---|---|
| CVE-2026-120869 | 9.4 | NetScaler Console | Authentication bypass (unauthenticated) | 14.1-74.34 and later |
| CVE-2026-107412 | 9.5 | ADC / Gateway as Gateway or AAA virtual server | Memory overflow, DoS | 14.1-73.57, 13.1-64.39 and later |
| CVE-2026-120868 | 9.3 | All ADC and Gateway deployments | Memory overflow in packet processing, DoS | 14.1-73.57, 13.1-64.39 and later |
| CVE-2026-111344 | 9.3 | VPN or AAA virtual server with Endpoint Analysis | Memory overflow in EPA/EPAS, DoS | 14.1-73.57, 13.1-64.39 and later |
| CVE-2026-120864 | 9.3 | Gateway VPN, AAA or CR virtual server of type HDX | Memory overflow in ICA proxy, DoS | 14.1-73.57, 13.1-64.39 and later |
| CVE-2026-107415 | 9.3 | ADC / Gateway with an Email Action | Memory overflow in Email OTP authentication, DoS | 14.1-73.57, 13.1-64.39 and later |
| CVE-2026-118268 | 8.5 | Secure Access Client for Windows | Privilege escalation to SYSTEM | 26.11.1.6 and later |
| CVE-2026-118269 | 8.5 | Secure Access Client for Linux | Privilege escalation to root | 26.10.4 and later |
The table lists five of the nine critical NetScaler ADC and Gateway flaws plus the Console bypass and the two client escalations. The remaining critical memory flaws (CVE-2026-107407, -107408, -107409 and -107410) apply only to SMPP, DNS and DNS-over-HTTPS load balancing and Push virtual servers. All of them are listed with configurations in The Hacker News report. Fixed builds for the appliance flaws: ADC and Gateway 14.1-73.57 or later, 13.1-64.39 or later, 14.1-FIPS 14.1-73.58 or later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 or later.
Why the Console bypass comes first
Most of the appliance bugs end in denial of service. CVE-2026-120869 is different: NetScaler Console manages your fleet, so an authentication bypass there reaches configuration, certificates and secrets for every appliance it controls. If your Console is reachable from outside the management network, fix that today and patch to 14.1-74.34 or later.
Patch order for a small team
- List what you run. Check the version of every NetScaler ADC, Gateway and Console, and which virtual server types are configured (VPN, AAA, DNS, SMPP, Push, Email OTP).
- Console first, then Gateways facing the internet, then internal ADCs.
- Then the clients. Secure Access Client needs 26.11.1.6 on Windows and 26.10.4 on Linux; these are local privilege escalations, so they matter most on shared or lightly managed laptops.
- Check management exposure. The management interface and Console should not be reachable from the internet.
- Review logs for the weeks before patching, even though no exploit is reported, because a fix often reveals the bug to attackers.
This is not the first NetScaler cluster we have covered. Read what to rotate after patching in Citrix NetScaler zero-days: rotate secrets after patching, and how the same pattern played out for other edge devices in SonicWall SSLVPN CVE-2026-19868 and Ivanti Connect Secure CVE-2026-104935.
FAQ
Are these flaws exploited? Citrix says it is not aware of exploits for any of the announced vulnerabilities.
Why were so many found at once? Citrix says the fixes follow a deeper code review that added AI-assisted analysis, aimed at hardening the products before attackers find the bugs.
Do I need to patch if I only use NetScaler as a load balancer? Yes for CVE-2026-120868, which affects all ADC and Gateway deployments. Others depend on configuration.
Is there a workaround? The reports we found list fixed builds only, so plan to upgrade.
Update 11 November 2026: attackers abused ScreenConnect to push rogue clients to hundreds of endpoints. See the ScreenConnect SCKit checklist.
