L3 · ShartedCitrix · NetScaler · VPN · authenticationnetscaler-november-security

Citrix fixes 28 NetScaler ADC and Gateway flaws and a Console authentication bypass

A packet-processing overflow affects default NetScaler ADC and Gateway deployments. Other flaws depend on features such as VPN or AAA. An unauthenticated attacker who can reach NetScaler Console can bypass its login controls. Update ADC and Gateway before Console.

Disclosed: Nov 12, 2026; Public disclosure date
Severity: CVSS 9.5 × 1; 29 CVEs tracked here
Splash zone: Customer-managed NetScaler ADC, Gateway and Console, including ADC/Gateway in Secure Private Access Hybrid deployments.; Citrix · NetScaler · VPN · authentication
In the wild: Not seen; Citrix reports no known exploitation and published no indicators for this batch.

What happened

Cloud Software Group published two NetScaler bulletins in the same release. CTX697305 lists 28 CVEs in customer-managed ADC and Gateway appliances. Its packet-processing overflow, CVE-2026-120868 (CVSS 4.0 9.3), affects the default configuration and can be triggered without authentication. CVE-2026-107412 (9.5) applies to appliances with Gateway or AAA virtual servers, including SSL VPN, ICA Proxy, CVPN or RDP Proxy configurations. The vendor describes unpredictable behavior or denial of service for these overflows. CTX697320 separately fixes the Console authentication bypass, CVE-2026-120869 (9.4), which requires network access to the Console IP.

The ADC/Gateway advisory also applies to NetScaler instances used by Secure Private Access Hybrid deployments. Citrix says the Citrix-managed cloud services in this release already received updates. The vendor lists no indicators and reports no known exploitation of the newly announced vulnerabilities. This release is separate from the September exploited NetScaler batch.

The default packet-processing path and the reachability of VPN gateways justify L3. Patch appliances even if the more narrowly configured features are absent. The vendor’s upgrade guidance gives the order and legacy licensing exception process.

What’s in the bowl

CVE-2026-120868CVSS 9.3

Packet engine overflow

Any ADC or Gateway configuration, including defaults. No authentication required.

CVE-2026-107407CVSS 9.3

SMPP overflow

Requires an SMPP load-balancing or content-switching virtual server.

CVE-2026-107408CVSS 9.3

DNS memory corruption

Requires DNS load balancing and recursive resolution.

CVE-2026-107409CVSS 9.3

DoH double free

Requires DNS-over-HTTPS load balancing.

CVE-2026-107410CVSS 9.3

Push overflow

Requires a PUSH load-balancing virtual server.

CVE-2026-107411CVSS 8.7

RTSP ALG overflow

Requires an RTSP load-balancing virtual server or an LSN group using RTSP ALG.

CVE-2026-107412CVSS 9.5

Gateway and AAA memory overflows

Unauthenticated path on Gateway or AAA virtual servers.

CVE-2026-107413CVSS 8.7

SAML overflow

Requires a SAML authentication action.

CVE-2026-107414CVSS 8.7

WebAuth overflow

Requires a WebAuth action.

CVE-2026-107415CVSS 9.3

Email OTP overflow

Requires an email authentication action.

CVE-2026-111340CVSS 8.7

Knowledge-based authentication overflow

Requires an LDAP action with KBAttribute or an email action.

CVE-2026-111341CVSS 8.7

Client-certificate overflow

Requires a client-certificate authentication action.

CVE-2026-111342CVSS 8.7

LDAP authentication overflow

Requires a Gateway or AAA virtual server.

CVE-2026-111343CVSS 6.9

Authentication request overflow

Requires a Gateway or AAA virtual server. The vendor’s CVSS vector specifies a local attack vector.

CVE-2026-111344CVSS 9.3

Endpoint Analysis overflow

Requires a VPN or AAA virtual server with Endpoint Analysis.

CVE-2026-111345CVSS 6.9

Request handling reboot loop

Requires reachability to the ADC or Gateway on the data path.

CVE-2026-111346CVSS 8.3

HTTP/2 overflow

Requires an HTTP or SSL virtual server with HTTP/2 enabled in its profile.

CVE-2026-111347CVSS 8.7

Base64 policy overflow

Applies to bound B64DECODE policy expressions or Application Firewall configurations.

CVE-2026-111348CVSS 6.9

Authentication data in logs

Requires local read access to /var/log/httperror.log after a logout occurred.

CVE-2026-111349CVSS 6.9

Application Firewall inspection overflow

Requires an AppFW profile with one of the affected inspection protections.

CVE-2026-120860CVSS 8.7

Protocol load-balancing overflow

Requires a Diameter, SIP-over-TCP, MQTT or RADIUS load-balancing virtual server.

CVE-2026-120861CVSS 8.7

GSLB and geolocation overflow

Requires GSLB MEP, static proximity, automatic configuration synchronization or a geolocation responder policy.

CVE-2026-120862CVSS 8.7

SIP ALG and DNS logging overflow

Requires SIP ALG on an LSN group or DNS answer-section security logging.

CVE-2026-120863CVSS 8.7

Management-plane overflow

An untrusted host needs access to the NSIP or NSIP6 address.

CVE-2026-120864CVSS 9.3

ICA proxy overflow

Requires a VPN Gateway, AAA virtual server or HDX content-redirection virtual server.

CVE-2026-120865CVSS 8.7

HTTP/3 overflow

Requires an HTTP_QUIC load-balancing or content-switching virtual server.

CVE-2026-120866CVSS 7.7

BGP routing overflow

Requires BGP with a neighbor lacking TCP-MD5 authentication. The attacker must be or spoof that neighbor.

CVE-2026-120867CVSS 8.7

SSL/TLS/DTLS overflow

Requires a TLS 1.3 virtual server with ECH (including the listed Intel QAT case) or an SSL virtual server with a SafeNet HSM key.

CVE-2026-120869CVSS 9.4

Console authentication bypass

An unauthenticated attacker who can reach the Console IP can access restricted resources.

Fixed versions

Product	Safe from	Note
NetScaler ADC and Gateway 14.1	`14.1-73.57`
NetScaler ADC and Gateway 13.1	`13.1-64.39`
NetScaler ADC 14.1-FIPS	`14.1-73.58 FIPS`
NetScaler ADC 13.1-FIPS / 13.1-NDcPP	`13.1-37.293`
NetScaler Console 14.1	`14.1-74.34`

Crime-scene timeline

Nov 12, 2026
Citrix publishes firmware and Console advisories
CERT-EU recommends prioritizing internet-facing Gateway and AAA appliances.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Citrix ADC and Gateway bulletin CTX697305PrimaryLists the 28 CVEs, feature prerequisites and firmware builds.
Citrix Console bulletin CTX697320PrimaryDocuments the Console bypass and its separate fix.
Citrix NetScaler upgrade guidancePrimaryCovers upgrade order, LAS licensing, ICA interruption and known exploitation status.
CERT-EU advisory 2026-020Prioritizes internet-facing Gateway and AAA appliances.

Wipe guide

The wipe checklist

0 of 4 sheets used

Patch ADC and Gateway firstPrioritize internet-facing Gateway and AAA appliances. Install 14.1-73.57 or 13.1-64.39, or the applicable FIPS/NDcPP build below. Apply updates across all affected nodes and plan for ICA sessions to reconnect.
Patch Console and check licensing before its upgradeInstall Console 14.1-74.34 or later after ADC/Gateway. If moving from pre-14.1-51.x with legacy pooled or flexed file licensing, coordinate the LAS file extension with your Citrix contact or partner and apply it before upgrading Console.
Check reachability and feature exposureIn the configuration, identify add vpn vserver and add authentication vserver entries. Use CTX697305 for protocol- and feature-specific checks. Restrict Console and NSIP/NSIP6 management access to trusted networks while rolling out patches.
Verify traffic and retain diagnosticsCheck the running build on each node. Test Gateway login, ICA reconnects, load-balanced services and Console management after the change. Preserve crash, reboot and access logs for investigation if anomalies persist.