Citrix NetScaler – 28 Memory Flaws, One Affecting Every Configuration (CVE-2026-120868 et al.)
Citrix has fixed 28 vulnerabilities in NetScaler ADC and Gateway. Several can be exploited over the network without authentication, and one affects every appliance – including those running the default configuration. The flaws are not yet being exploited, but that is likely to change quickly. There is no workaround; only the update helps.
What happened?
On November 12, 2026, Citrix published 28 vulnerabilities in NetScaler ADC and Gateway in bulletin CTX697305. Almost all of them are memory flaws that, according to Citrix, can lead to "unpredictable or erroneous behavior or Denial of Service". For several of them, however, Citrix's CVSS rating also scores the impact on confidentiality and integrity as high – so more than a crash cannot be ruled out.
The most important flaws:
- CVE-2026-120868 (CVSS 9.3): A memory flaw in packet processing. Every NetScaler appliance is affected, including the default configuration. No authentication is required.
- CVE-2026-107412 (CVSS 9.5): Multiple memory flaws on appliances running as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server – exactly the appliances that are typically exposed to the internet.
- CVE-2026-120864 and CVE-2026-111334 (CVSS 9.3 each): Memory flaws in ICA Proxy and Endpoint Analysis (EPA), also on Gateway and AAA appliances.
- CVE-2026-107415 (CVSS 9.3): A memory flaw in Email OTP authentication.
The remaining flaws only affect appliances with specific features enabled, such as SAML, LDAP, client certificates, HTTP/2, HTTP/3, DNS or DNS-over-HTTPS, the Application Firewall or BGP. Another flaw (CVE-2026-111338) writes authentication data to a log file on the appliance.
According to Citrix, the flaws are not yet being exploited and there is no public exploit. With NetScaler, however, this has often changed within a few days in the past.
Who is affected?
- NetScaler ADC and Gateway 14.1 before 14.1-73.57
- NetScaler ADC and Gateway 13.1 before 13.1-64.39
- NetScaler ADC 14.1-FIPS before 14.1-73.58 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.293
- Secure Private Access Hybrid, if NetScaler instances are in use
Because of CVE-2026-120868, checking the configuration does not help: every appliance running an older version is affected. Citrix-managed cloud services and Adaptive Authentication are updated by the vendor.
Unsupported versions such as 12.1 and 13.0 receive no updates and should be replaced.
What needs to be done?
- Update: Upgrade to 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP or later. Start with appliances that are reachable from the internet as a Gateway or AAA virtual server.
- Protect management access: One of the flaws (CVE-2026-120863) affects the management interface. Make sure the NSIP is not reachable from the internet or from untrusted networks.
- Clean up the log file: Because of CVE-2026-111338, authentication data may be stored in
/var/log/httperror.log. Check who has access to the appliance, and delete or rotate the log after the update. - Watch for anomalies: Unexpected crashes or reboots of the NetScaler can indicate exploitation attempts. Review the logs regularly until the update is in place.
This advisory is for informational purposes. Contact us for assistance securing your Citrix infrastructure.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call