Citrix patches 10 critical NetScaler flaws, including a 9.4 Console bypass
Citrix patched 28 NetScaler ADC and Gateway flaws, nine critical memory overflows that can disrupt traffic and authentication, plus a 9.4 unauthenticated bypass in NetScaler Console. The vendor does not report exploitation. Unpatched edge appliances that terminate remote access are the systems left exposed.
Citrix on Thursday shipped fixes for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, nine of them critical, and a separate critical flaw in NetScaler Console. The nine appliance bugs are memory overflows in packet processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, email one-time-password authentication, Endpoint Analysis, and the ICA proxy. Tracked as CVE-2026-120868, CVE-2026-107407 through CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334, and CVE-2026-120864, they can cause unpredictable behavior or denial of service, Citrix says. The Console bug, CVE-2026-120869, scores 9.4 and can let an unauthenticated attacker bypass controls and reach restricted resources.
Fixed code is in ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later. Every NetScaler Console 14.1 release before 14.1-74.34 is affected by the bypass. Of the remaining 19 ADC and Gateway defects, most are high severity and lead to similar disruption. One medium-severity bug, CVE-2026-111338, writes sensitive authentication material into a log file. Citrix listed preconditions for some of the flaws and told customers to update as soon as possible. The notice does not say any of the bugs are being exploited.
These appliances terminate remote sessions at the network edge, so a fault in packet handling, DNS, or the ICA proxy takes applications published behind them offline. The Console bypass is a different failure: unauthenticated access to restricted management resources, scored 9.4, not a service crash. Vendor wording and independent evidence stay separate. Citrix does not report exploitation, and the notice has no outside confirmation the flaws are in use. The documented pattern is that NetScaler bugs are a frequent target when gateway builds stay unpatched.
The exposed set is any organization running affected ADC, Gateway, or Console builds, including FIPS and NDcPP variants used where cryptographic and procurement baselines are mandatory. Denial of service in packet processing, DNS, email one-time passwords, Endpoint Analysis, or the ICA proxy can drop remote access and published apps. CVE-2026-111338 can leave authentication material in logs. CVE-2026-120869 can let an unauthenticated party reach restricted Console resources on 14.1 builds before 14.1-74.34. Instances below the listed patch levels remain the ones Citrix says are unfixed.
Organizations that publish remote access through affected NetScaler ADC, Gateway, or Console builds can lose that access to denial of service, leak authentication material into logs, or face an unauthenticated path to restricted Console resources until they install the listed builds.
Sources (1)
- [1]Original source(https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/)