Citrix fixes 28 NetScaler ADC and Gateway flaws, a critical NetScaler Console auth bypass and client privilege escalation

What happened

On Thursday 12 November 2026 Cloud Software Group, the company behind Citrix, published four security bulletins:

The bulletins do not mention exploitation and offer no workarounds – Citrix "strongly urges" customers to upgrade as soon as possible. The NetScaler bulletin applies only to customer-managed appliances; Citrix-managed cloud services are upgraded by the vendor. Some of the bugs were found by Cloud Software Group's internal team using AI-assisted code analysis; others were reported by outside researchers, including two from watchTowr.

Technical details

The details below come from Citrix's bulletins. Since 12–13 Nov 2026 NVD has been publishing the records supplied by Citrix (status Received / Awaiting Analysis, with no NIST analysis yet); as of 13 Nov no technical write-up has been published. We do not publish exploitation guidance.

Critical flaws in NetScaler ADC and Gateway (CVSS 4.0 ≥ 9):

The remaining 19 flaws score 6.9–8.7 and sit in specific features: SAML, WebAuth, LDAP, KBA and client-certificate authentication, HTTP/2, HTTP/3 (QUIC), RTSP, SIP, Diameter, MQTT, RADIUS, GSLB, BGP without TCP-MD5, TLS 1.3 with ECH, Base64 decoding in policies, Web App Firewall and the management interface (NSIP) – CVE-2026-120863 (8.7) hits any appliance whose NSIP is reachable from an untrusted network. CVE-2026-111348 (6.9) writes sensitive authentication data to /var/log/httperror.log.

Most descriptions are brief: a memory overflow "can lead to unpredictable or erroneous behavior or Denial of Service". The vector for CVE-2026-120868, though, is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H – network attack, no authentication, no user interaction, with high impact on confidentiality and integrity. So the vendor does not rule out data leaking from the appliance's memory.

NetScaler Console (CVE-2026-120869, CVSS 9.4, CWE-287): an unauthenticated attacker who can reach the Console IP address can bypass authentication and access restricted resources. The AV:A vector assumes an attacker on an adjacent network, but the impact extends to downstream systems (SC:H/SI:H/SA:H) – Console manages the configuration and certificates of every connected NetScaler.

Secure Access clients (CVE-2026-118268 and CVE-2026-118269, CVSS 8.5, CWE-269): a standard user on a machine with the VPN client can escalate to SYSTEM (Windows) or root (Linux). The attacker needs local access first, so this is a post-compromise step on an endpoint.

Who is affected

• Secure Private Access Hybrid deployments that use NetScaler instances are affected too.
• The 12.1 and 13.0 branches are not listed – they are unsupported and receive no fixes.
• To see which features you run, check ns.conf – for each flaw the bulletin gives the configuration lines that indicate a vulnerable setup (for example add vpn vserver, add authentication vserver, add authentication emailAction, -http2 ENABLED, B64DECODE).

How to tell if you were compromised

Citrix has published no indicators of compromise and reports no exploitation. What we would watch (our own advice, not Citrix guidance):

• Unexpected restarts and crashes of the packet engine (crash dumps, restart entries in /var/log/ns.log) – with memory overflows these are often the first sign of attempts.
• New or unknown files in the appliance's web directories and new cron jobs – compare them with a clean install of the same build.
• Unusual VPN and AAA sessions – sign-ins from unexpected countries, one user holding concurrent sessions from different IPs.
• Access to the NSIP and NetScaler Console from addresses outside the admin network.

Once Citrix or a CERT publishes indicators, you can pull them out of the text with our IOC extractor. Break down the CVSS 4.0 vectors with the CVSS calculator.

What to do

1. Internet-facing NetScaler Gateway and AAA: upgrade first, to 14.1-73.57 or 13.1-64.39 (FIPS 14.1-73.58, FIPS/NDcPP 13.1-37.293).
2. All other NetScaler ADC appliances: upgrade too – CVE-2026-120868 applies to every deployment regardless of features.
3. NetScaler Console: upgrade to 14.1-74.34 and until then restrict access to its IP to the admin network.
4. Management interface (NSIP): never expose it to the internet or to user networks; CVE-2026-120863 makes that doubly important.
5. Secure Access clients: roll out 26.11.1.6 (Windows) and 26.10.4 (Linux) through your endpoint management, or have the Gateway offer the new client version.
6. After upgrading, confirm the new build is running (show ns version) and go through the checks above. If you suspect a compromise, upgrading alone is not enough – the appliance needs to be investigated and rebuilt.

Timeline

Updates

• 13 Nov 2026 – NVD has taken over the first records from Citrix (including CVE-2026-120868 and seven other critical ADC/Gateway flaws); NIST has not analysed them yet. For CVE-2026-120869 (Console) the NVD record differs from the bulletin: NVD lists 9.3 with AV:N (network) and a lower impact on subsequent systems, while bulletin CTX697320 gives 9.4 with AV:A (adjacent network). This article follows the bulletin; the practical advice is the same either way – upgrade Console and restrict its IP to the management network. The flaws are still not in CISA KEV, Citrix reports no exploitation, and no technical write-up (e.g. from watchTowr) has been published yet.
• 12 Nov 2026 – first version of this article.