Security alerts · November 13, 2026

Citrix NetScaler ADC and Gateway: critical memory flaws can cause outages without login

On November 12, 2026, Citrix fixed 28 memory flaws in NetScaler ADC and NetScaler Gateway. One of them affects every appliance, even with default settings, and can be reached without logging in. No exploitation is known yet. Update as soon as possible, starting with internet-facing gateways.

What happened

On November 12, 2026, Cloud Software Group, the company behind the Citrix brand, published security bulletins fixing 28 memory handling flaws in NetScaler ADC and NetScaler Gateway, as reported by the EU’s CERT-EU team. NetScaler ADC balances traffic across servers and protects web applications. NetScaler Gateway is the entry point for remote staff, for example via VPN or to Citrix virtual desktops.

CVE-2026-120868, in core network packet processing, has the widest reach. According to the vendor, it affects all deployments, including those with the default configuration. CVE-2026-107412 has the highest score and covers several memory flaws in appliances configured as a gateway or an authentication (AAA) server. According to The Hacker News, CVE-2026-107410 in NetScaler Push affects appliances with a load balancing virtual server of type PUSH. The remaining flaws only matter if specific features are turned on.

According to CERT-EU, Citrix reports no exploitation and no public proof-of-concept code has been confirmed. The flaws are not in the CISA KEV catalog, and the EU vulnerability database EUVD does not list them as exploited. The Hacker News reports that Citrix found the flaws during a deeper review of its own code using AI-assisted analysis.

Why it is dangerous

These are memory overflow bugs. Picture pouring more water into a glass than it can hold. The water spills over and soaks everything nearby. In software, data overwrites neighbouring areas of memory where it does not belong, and the device then behaves unpredictably or crashes.

For CVE-2026-120868, CERT-EU says an attacker needs no login and no special feature. The appliance only has to receive network traffic, which for an internet-facing gateway means an attack could come from anywhere. The vendor says the flaws in CVE-2026-107412 can also be reached without authentication.

The vendor describes the impact as unpredictable behaviour and denial of service (DoS), in other words an outage. If NetScaler Gateway goes down, remote staff lose access to company systems. The vendor does not mention device takeover or data theft. However, CERT-EU points out that ten of the flaws are scored as having high impact on confidentiality, integrity and availability, even though the vendor bulletin only describes them as unpredictable behaviour or DoS.

CVSS is a severity scale from 0 to 10. CVE-2026-120868 and CVE-2026-107410 score 9.3 and CVE-2026-107412 scores 9.5 under the newer CVSS 4.0, which is critical. The high score mainly reflects that the attack works over the network, is simple and needs neither a login nor any user action.

The CISA KEV catalog is a list kept by the US agency CISA of flaws that attackers are known to exploit. These flaws are not on it. An EPSS score, which estimates the likelihood of exploitation in the next 30 days, is not yet available for them.

Who is affected

The following NetScaler ADC and NetScaler Gateway versions are affected:

  • 14.1 before 14.1-73.57
  • 13.1 before 13.1-64.39
  • NetScaler ADC FIPS before 14.1-73.58 FIPS
  • NetScaler ADC FIPS and NDcPP before 13.1-37.293

CVE-2026-120868 affects every deployment regardless of configuration. The other flaws depend on enabled features: gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), AAA server, SAML, WebAuth, LDAP, email one-time codes or client certificate login, DNS over HTTPS, HTTP/2, HTTP/3 (QUIC), SMPP, RTSP, BGP routing and the Application Firewall.

Typical users are companies that use NetScaler Gateway for remote work, Citrix virtual desktops or internal apps, and organisations where NetScaler ADC balances traffic for web services. CERT-EU’s recommendation explicitly targets customer-managed appliances. If you do not run NetScaler, these flaws do not affect you.

According to The Hacker News, Citrix also fixed a critical authentication bypass in NetScaler Console (CVE-2026-120869, fixed in 14.1-74.34 and later) and flaws in Secure Access Client for Windows (26.11.1.6 and later) and Linux (26.10.4 and later). If you use these products, update them as well.

How to check if you are affected

In the NetScaler web interface, you can see the version on the Dashboard after logging in, or under System, System Information. From the command line over SSH, use this command, which only displays the version:

show ns version

The output shows the release line (for example NS14.1) and the build number. Compare it with the list of affected versions. If the output mentions FIPS or NDcPP, separate fixed versions apply to you.

To find out whether a gateway or AAA server is configured, which should be updated first, use these commands. They only display settings and change nothing:

show vpn vserver
show authentication vserver

How to fix it

The vendor fixed the flaws in these versions:

  • NetScaler ADC and Gateway 14.1-73.57 and later
  • NetScaler ADC and Gateway 13.1-64.39 and later 13.1 releases
  • NetScaler ADC 14.1-FIPS: 14.1-73.58 FIPS and later
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.293 and later

Neither CERT-EU nor The Hacker News mentions any vendor workaround that could replace the update. Upgrading to a fixed version is therefore the only protection.

Recommended steps:

  • List all NetScaler appliances in your organisation and check their versions.
  • Update internet-facing Gateway and AAA appliances first, as CERT-EU recommends. Then the rest.
  • Save and back up the configuration before upgrading and plan a short maintenance window.
  • Download firmware only from the official Citrix portal.
  • For a high availability (HA) pair, upgrade the secondary node first, fail over to it, then upgrade the former primary.
  • After the reboot, confirm the version with show ns version and test logins and VPN.

Until the update is in place, a sensible general measure is to restrict the management interface to the internal network and watch for unexpected appliance reboots.

What if you may already be compromised

Neither Citrix nor CERT-EU reports any exploitation so far, and the vendor has not published indicators of compromise. Since the vendor describes the impact as unpredictable behaviour and outages, an attack attempt would most likely show up as unexpected crashes and reboots.

What to check:

  • Unexpected reboots or crashes in recent weeks, and crash dump files in the /var/core directory.
  • The system log /var/log/ns.log and records of administrator logins.
  • Unknown admin accounts (command show system user) and configuration changes nobody can explain.

If you find repeated unexplained crashes, unknown accounts or configuration changes, save the logs first and only then update or reinstall the appliance. Bring in an incident response specialist or Citrix support.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

← All alerts · RSS

Need help patching or checking your systems?

I can help you find out which systems are affected, update them safely and check whether an attacker already got in. Let us start with an initial consultation, which is deducted from the project price if we work together.

See pricing [email protected]