Citrix patches 12 NetScaler and Secure Access flaws, including authentication bypass
Citrix patched 12 flaws across NetScaler appliances, Console and Secure Access Client, including a critical authentication bypass and several memory corruption issues. The update matters because these components often sit at enterprise network edges and control remote access, so unpatched systems can expose internal resources or lose administrative control.
Citrix published security updates covering NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client for Windows and Linux. The batch includes CVE-2026-120869, a 9.4-rated improper authentication flaw in NetScaler Console that could let an unauthenticated attacker bypass controls and reach restricted resources. It also includes nine critical memory overflow or corruption issues in NetScaler ADC and Gateway, several rated 9.3 or 9.5, affecting packet processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP, Endpoint Analysis and ICA proxy.
The advisory lists fixed versions: NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, plus FIPS and NDcPP builds; NetScaler Console 14.1-74.34 and later; Secure Access Client 26.11.1.6 on Windows and 26.10.4 on Linux. The highest CVSS score in the set is 9.5 for multiple memory overflows in Gateway or AAA virtual server configurations. Citrix said it integrated AI-assisted code analysis to find issues, and that it is not aware of active exploitation.
NetScaler appliances sit at the edge of enterprise networks, mediating VPN access, load balancing and application proxying. That placement makes them high-value targets: a flaw in an AAA virtual server, short for authentication, authorization and accounting, or an ICA proxy can expose internal systems without valid credentials, while memory corruption in DNS or packet paths can disrupt traffic. The patch set spans appliance management and client software, showing risk is not limited to one protocol path but includes console access, Windows privilege escalation and Linux root escalation.
Organizations running Citrix remote access or load-balancing infrastructure are urged to update appliances and clients, because unpatched systems include broad-facing services at the network edge. The authentication bypass in Console could give an attacker administrative access to the device, while privilege escalation flaws in Secure Access Client could let a local user take control of a workstation. Citrix's lack of known exploitation lowers immediate urgency, but the critical scores and remote-access role make the fixes operationally important.
It affects enterprises using Citrix remote access and load-balancing infrastructure, where an authentication bypass or memory flaw could expose internal networks, disrupt services or let attackers control devices and workstations.
Sources (1)
- [1]Original source(https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html)