Citrix Patches 10 Critical NetScaler Vulnerabilities

Citrix on Thursday released security updates fixing twenty-eight vulnerabilities across NetScaler ADC and NetScaler Gateway, alongside a critical flaw in NetScaler Console. As detailed in SecurityWeek's report, the security advisory addresses ten critical-severity vulnerabilities capable of causing denial-of-service states or allowing unauthorized resource access. The patches resolve severe memory corruption issues across core gateway subsystems alongside authentication data exposures.

This technical review details the specific CVE assignments, memory overflow root causes, administrative bypass risks, and patched firmware builds across active release tracks. Enterprise security engineers, network architects, and system administrators running NetScaler networking infrastructure need this breakdown to plan emergency maintenance. Every relevant software version, affected protocol handler, and operational requirement is covered here directly.

01Memory overflow defects in packet processing

The primary threat concentration across NetScaler ADC and Gateway involves nine critical-severity security defects rooted in memory overflow conditions. These memory flaws undermine core operational functions including standard Packet Processing pipelines, SMPP traffic handlers, and Domain Name System resolution routines. Attackers who trigger these buffer conditions can induce unpredictable behavior, system execution errors, or total denial-of-service failures.

Engineers identified matching memory overflow weaknesses within DNS-over-HTTPS processing, NetScaler Push mechanisms, and Email one-time password authentication flows. Similar buffer vulnerabilities affect client verification during Endpoint Analysis, EPAS routines, and active ICA proxy sessions. These nine critical flaws are tracked as CVE-2026-120868, CVE-2026-107407 through CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334, and CVE-2026-120864.

02Log exposure and authentication bypass flaws

Beyond the nine memory overflows in ADC and Gateway, Citrix addressed nineteen additional security weaknesses across the same appliances. Most of these nineteen remaining defects are high-severity vulnerabilities that lead to similar unpredictable execution states and service outages under load. Citrix also resolved several medium-severity defects, including CVE-2026-111338, which exposes sensitive authentication material directly inside appliance log files.

Simultaneously, Citrix disclosed a standalone critical vulnerability within its centralized management appliance, NetScaler Console. Designated as CVE-2026-120869, this administrative security defect carries an exceptionally severe CVSS score of 9.4. The vulnerability allows unauthenticated remote attackers to bypass access controls and interact with restricted administrative resources across the network.

03Gateway builds and fixed firmware releases

Citrix rolled out patched firmware packages across multiple active NetScaler ADC and Gateway software branches to remediate the flaws. Production deployments operating the 14.1 series must upgrade to version 14.1-73.57 or subsequent releases to secure their perimeter. Organizations maintaining the earlier 13.1 branch must install release version 13.1-64.39 or newer to apply the required memory fixes.

Regulated deployments utilizing Federal Information Processing Standards firmware require distinct packages supplied by the vendor. Hardened environments running 14.1 must deploy version 14.1-73.58 FIPS or later to resolve the flaws. Deployments configured under 13.1-FIPS and 13.1-NDcPP designations must update to version 13.1-37.293 or higher firmware.

Addressing the critical management flaw requires an independent upgrade path for organizations maintaining NetScaler Console installations. The CVE-2026-120869 defect compromises all NetScaler Console 14.1 releases prior to version 14.1-74.34. Administrators must apply NetScaler Console version 14.1-74.34 or newer releases immediately to restore access control protections.

04Attack preconditions and network service exposure

Exploiting these security defects depends upon the specific features and protocol listeners enabled on an individual appliance. In its published advisory, Citrix detailed explicit CVE preconditions associated with several vulnerabilities, clarifying which traffic profiles expose target code paths. NetScaler instances that do not process targeted protocols like DoH or Email OTP remain protected from exploitation attempts against those subsystems.

Exposure risk also depends on whether affected services face untrusted external clients or remain isolated inside private management perimeters. Because Gateway appliances actively terminate external connections for remote workers, exposed endpoints executing ICA proxy or Endpoint Analysis routines face immediate risk. Conversely, the CVSS 9.4 Console bypass requires network route access to administrative interfaces, making management subnet filtering an effective interim barrier.

05Exploitation history and immediate administrator guidance

Citrix confirmed that none of the twenty-eight disclosed vulnerabilities have been observed in active, in-the-wild cyberattacks prior to publication. Despite the absence of zero-day exploitation, enterprise security teams must treat the advisory with urgent priority. Network gateway appliances and application delivery controllers remain frequent, prized targets for threat actors seeking footholds into enterprise corporate networks.

Citrix explicitly urges all enterprise customers to update their NetScaler instances as soon as possible to mitigate risk. Security administrators should inventory internet-facing ADC and Gateway appliances, confirm running build numbers, and review documented preconditions. Upgrading vulnerable NetScaler Console instances and gateway controllers eliminates both unauthorized administrative access and perimeter denial-of-service vectors.