Citrix Fixed 28 NetScaler Bugs on November 12, and One Hits Every Appliance in Its Default Configuration. Upgrade Gateway and AAA First. There Is No Workaround.
If you run Citrix NetScaler ADC or NetScaler Gateway, install a fixed build: 14.1-73.57 or later, 13.1-64.39 or later, 14.1-73.58 FIPS or later, or 13.1-37.293 FIPS/NDcPP or later. Do the internet-facing Gateway and AAA appliances first. One of the bugs, CVE-2026-120868, affects every NetScaler in its default configuration, so no appliance gets to skip this. If you run NetScaler Console, upgrade it to 14.1-74.34 or later: it has a separate authentication bypass, CVE-2026-120869. Citrix's bulletins list no workaround for any of these flaws. The fixed build is the only fix.
Nobody has reported exploitation yet. That is the good news, and the reason to patch now.
What is confirmed
We read Citrix's own bulletins on November 13: CTX697305 for NetScaler ADC and Gateway, CTX697320 for NetScaler Console, and CTX697280 and CTX697281 for the Secure Access Client. All four carry an initial publication date of November 12, 2026.
The ADC and Gateway bulletin is bigger than the headlines. The press reported 12 flaws across all four products. CTX697305 alone lists 28 CVEs. Nine of them score 9.3 or higher on CVSS 4.0. The rest score between 6.9 and 8.7, and most of those are denial of service. Add the Console bypass and the two Secure Access Client bugs and Citrix fixed 31 CVEs on November 12. The bulletin's changelog shows Citrix renumbered seven of the CVEs on the same day, which may be why early reports differ.
The one that applies to everybody. CVE-2026-120868 is a memory overflow in packet processing, CVSS 9.3. Citrix's precondition reads: "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)." Its instructions add that "No additional features or settings need to be enabled for the NetScaler deployment to be vulnerable." Citrix describes the impact of this and the other memory bugs as "unpredictable or erroneous behavior or Denial of Service." The CVSS vectors also score confidentiality and integrity as high, but the bulletin text does not say remote code execution, so we will not either.
The Gateway and AAA cluster. Three of the nine critical bugs need the appliance to be a Gateway or an authentication server, which is exactly the role most internet-facing NetScalers play:
CVE-2026-107412, CVSS 9.5, the highest score in the bulletin: "Multiple Memory overflow vulnerabilities," when NetScaler "is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server."
CVE-2026-120864, CVSS 9.3, memory overflow in ICA proxy: Gateway VPN virtual server, AAA virtual server, or CR virtual server of type HDX.
CVE-2026-111334, CVSS 9.3, memory overflow in Endpoint Analysis: a VPN or AAA virtual server with Endpoint Analysis (EPA) configured.
Two more Gateway and AAA bugs sit just below critical: CVE-2026-111342 (LDAP authentication, 8.7) and CVE-2026-111333 (authentication request, 6.9). And several authentication features have their own entries: SAML actions (CVE-2026-107413, 8.7), WebAuth (CVE-2026-107414, 8.7), client certificate authentication (CVE-2026-111341, 8.7), and knowledge-based authentication (CVE-2026-111340, 8.7).
The critical bugs that need a feature switched on. Five more critical entries apply only if you use the feature:
CVE-2026-107415, CVSS 9.3: Email OTP, any authentication emailAction.
CVE-2026-107408, CVSS 9.3: DNS load balancing with recursive DNS resolution.
CVE-2026-107409, CVSS 9.3: DNS load balancing over HTTPS (DoH).
CVE-2026-107407, CVSS 9.3: a load balancing or content switching virtual server of type SMPP.
CVE-2026-107410, CVSS 9.3: a load balancing virtual server of type PUSH.
One for the management network. CVE-2026-120863 (8.7) is a memory overflow in the management plane. Citrix's precondition: "An attacker on an untrusted host must be able to reach the NetScaler appliance's NSIP or NSIP6 address."
Fixed builds, from CTX697305: NetScaler ADC and Gateway 14.1-73.57 and later; 13.1-64.39 and later releases of 13.1; NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS and later; NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later. The bulletin names only these supported branches. Older branches are not listed as fixed.
Secure Private Access hybrid is in scope. The bulletin says Secure Private Access hybrid deployments using NetScaler instances are affected, and those NetScaler instances need the same builds. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by Citrix.
NetScaler Console, CTX697320. CVE-2026-120869, CWE-287 improper authentication: "An unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance." Precondition: "Access to Citrix NetScaler Console IP." The bulletin scores it 9.4 with an adjacent-network attack vector. Affected: Console 14.1 before 14.1-74.34. Fixed: 14.1-74.34 and later.
Secure Access Client. CVE-2026-118268 lets a low-privileged user on Windows escalate to SYSTEM (fixed in 26.11.1.6 and later, CTX697280). CVE-2026-118269 lets a low-privileged user on Linux gain root (fixed in 26.10.4 and later, CTX697281). Both score 8.5 and need a local account.
Credits. Citrix acknowledges Michael Tucker and Chew Keong Tan of JPMorgan Chase's XOR team, Kyle Hannon of CapitalOne Offensive Security, and Himanshu Anand and Sina Kheirkhah of watchTowr. It says its own product security team found several of the flaws "through advanced AI-assisted code analysis," and credits that work alone for the Console and Secure Access Client bugs.
What is not known
Exploitation. None of Citrix's four bulletins mentions it either way. The Hacker News reported on November 12 that Citrix "said it's not aware of any exploits for any of the announced vulnerabilities." We could not open the Citrix community blog post that statement appears to come from (HTTP 403), so treat it as Citrix speaking through the press.
CISA's view. None of the 31 CVEs is in the KEV catalog we downloaded on Friday, November 13. That catalog is version 2026.11.10, released Tuesday, November 10, two days before the bulletins. So the absence tells you nothing yet, in either direction.
Whether any of these goes beyond a crash. Citrix's descriptions say "unpredictable or erroneous behavior or Denial of Service." Several CVSS vectors rate confidentiality and integrity impact as high. Citrix has not published more than that, and we will not guess.
Mitigations. The bulletins list none. Earlier NetScaler bulletins sometimes offered Global Deny List signatures or a responder policy. These do not. If Citrix adds one, the bulletin changelog is where it will appear.
Session cleanup. Citrix has not asked customers to end active sessions after upgrading this time. That step has appeared in past NetScaler guidance for memory-leak bugs that exposed session tokens. These bulletins describe overflows and denial of service, not a leak. Follow Citrix if that changes.
What to do
Find every NetScaler, including the ones nobody remembers. CVE-2026-120868 needs no feature at all, so each ADC and Gateway on an older build is exposed. Include HA peers, cluster nodes, and NetScaler instances behind Secure Private Access hybrid.
Patch the internet-facing Gateway and AAA appliances first. Citrix's own check: if your configuration contains "add vpn vserver" or "add authentication vserver," you meet the precondition for CVE-2026-107412, the 9.5. That is the box attackers reach from the internet, and it is where three of the nine critical bugs live.
Then everything else, on the same builds. 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, or 13.1-37.293 FIPS/NDcPP, or later. The bulletin gives a configuration line to grep for every precondition (for example "add authentication emailAction" for CVE-2026-107415, or "add lb vserver" with type SMPP or PUSH). Use those lines to rank the rest, not to decide whether to patch. Every one of these builds is affected by CVE-2026-120868.
Upgrade NetScaler Console to 14.1-74.34 or later. Until you do, keep the Console IP reachable only from your admin network. That is not a Citrix-listed workaround. It follows from Citrix's precondition that the attacker needs to reach the Console IP, with an adjacent-network attack vector.
Keep the NSIP off untrusted networks. Same reasoning: CVE-2026-120863's precondition is an untrusted host that can reach the NSIP or NSIP6.
Push the Secure Access Client updates to managed Windows and Linux endpoints: Windows 26.11.1.6, Linux 26.10.4.
Watch the bulletin and the KEV catalog. NetScaler has a short gap between disclosure and exploitation, and the next section is why we say that.
Why we would not wait for exploitation
CISA's KEV catalog lists 27 Citrix CVEs. Six of them are NetScaler bugs added this year alone: CVE-2026-3055 on Monday, March 30; CVE-2026-8452 on Wednesday, August 26; CVE-2026-19490 on Wednesday, September 9; CVE-2026-88771 and CVE-2026-88772 on Sunday, September 27; and CVE-2026-88779 on Sunday, October 4. Five of those six landed in a 39-day window. Four earlier NetScaler entries in that list, CVE-2019-19781, CVE-2023-3519, CVE-2023-4966 (Citrix Bleed) and CVE-2025-5777, carry CISA's "Known" ransomware-use flag.
The broader pattern points the same way. Across the 1,779 entries in the KEV catalog, a product's past count of exploited bugs predicts its additions over the last 180 days with a Spearman correlation of 0.5, and half of the 187 additions in that window were products that had been on the list before. That is a measure of products, not of exploit timing, and it says nothing about these specific bugs. It does say that NetScaler is the kind of product attackers come back to. Source: our kev-exploitation-stickiness and kev-vendor-risk tools, computed from the CISA KEV catalog on November 13.
We covered two of this year's waves: CVE-2026-3055, the SAML bug that was mass-exploited, and CVE-2026-88779, which crashed appliances that had already been patched.
How we know, and what our own instruments say
Primary sources. The four Citrix bulletins, read in full from support.citrix.com on November 13. The CVE.org records for the ten CVEs that had been published there, all assigned by NetScaler. The CISA KEV catalog JSON, downloaded November 13. Weekdays are computed from the dates, not copied.
Where the sources disagree.
The Hacker News lists the Endpoint Analysis bug as CVE-2026-111344. Citrix's bulletin says CVE-2026-111334. The CVE.org record for CVE-2026-111344 belongs to an unrelated APITable bug. Use CVE-2026-111334 in your tickets.
Citrix's bulletin scores the Console bypass 9.4 with an adjacent-network vector. The CVE.org record filed by NetScaler says 9.3 with a network vector. We used the bulletin.
The CVE.org records for the two Secure Access Client CVEs did not exist yet when we checked.
A community-built read-only checker on GitHub (ThomasPoppelgaard/netscaler-ctx697096-checker) gives 14.1-73.58 as the fixed 14.1 build in its repository description. Citrix's bulletin says 14.1-73.57 for standard builds and 14.1-73.58 for FIPS. Go by the bulletin.
Proof-of-concept watch. Our exploit harvester, which collects public GitHub repositories by CVE number, holds no repository for any of these CVEs as of November 13. It is running: it wrote its newest marker on November 13 at 12:03 UTC and has logged 16 to 25 a day this week. A direct GitHub search for the critical CVE numbers turned up only that read-only checker. The checker is a defender's tool, not an exploit, and we have not run it. No public exploit code exists for these bugs that we know of.
Edge check. We run no NetScaler, so we had nothing to patch. Citrix published no exploit paths, so there was nothing specific to look for. We checked the generic NetScaler Gateway and login paths (/vpn/, /cgi/, /nf/auth/, /logon/LogonPoint, /oauth/idp, /saml/) since November 1: 0 of 366,579 edge-blocked requests, 0 of 44,924 decoy hits, 0 of 374 requests that reached our origin. To confirm the search works, a WordPress path check over the same window found 1,828 blocked requests. Read the zero carefully. We have no NetScaler decoy, our sites are not NetScaler appliances, and those paths would be ordinary product inventory scanning, not evidence of any of these CVEs. Our edge could not have seen an attack on these bugs, and a hit would not have proved one.
Feed. Citrix published no network indicators, so we added none. CVEs reach our KEV index automatically when CISA lists them.
Sources
Citrix (Cloud Software Group), CTX697305, "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin," initial publication November 12, 2026, renumbering update the same day (support.citrix.com). Citrix, CTX697320, "Citrix NetScaler Console Security Bulletin for CVE-2026-120869," November 12, 2026. Citrix, CTX697280, Secure Access Client for Windows bulletin for CVE-2026-118268, November 12, 2026. Citrix, CTX697281, Secure Access Client for Linux bulletin for CVE-2026-118269, November 12, 2026. CVE.org records via the CVE Services API, retrieved November 13. CISA Known Exploited Vulnerabilities catalog, JSON feed, version 2026.11.10, downloaded November 13. Press lead, used for the exploitation statement only: The Hacker News report on Citrix patching 12 NetScaler and Secure Access Client flaws, November 12, 2026 (thehackernews.com).
The KEV history and stickiness figures are computed by DugganUSA from CISA's catalog. The PoC and edge measurements are ours, taken November 13, 2026. We cap ourselves at 95 percent confidence.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments