Citrix NetScaler ADC and Gateway CVE-2026-120868: Critical Bulletin, 28 Flaws — Patch Now

Citrix has published a new security bulletin, CTX697305, covering 28 vulnerabilities in customer-managed Citrix NetScaler ADC and NetScaler Gateway. The bulletin rates the issue set Critical. The headline flaw, CVE-2026-120868, is a memory overflow in packet processing that affects all NetScaler ADC and NetScaler Gateway deployments, including the default configuration. Citrix scores it CVSS 4.0 9.3, and the NetScaler CNA record on CVE.org matches. The highest score in the bulletin is CVSS 4.0 9.5 for CVE-2026-107412, which applies when NetScaler is configured as a Gateway or an AAA virtual server; the CNA record matches.

Fixed builds are available. Cloud Software Group "strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible."

This is a new advisory on the 12 November 2026 bulletin. It is not an update of our earlier NetScaler posts on CVE-2026-19490 or CVE-2026-88771 and CVE-2026-88772. Those are separate flaws. None of the 28 CVEs in CTX697305 is in the CISA Known Exploited Vulnerabilities (KEV) catalog as of 13 November 2026, and the bulletin does not report exploitation.

Technical Information

All scores in CTX697305 are vendor CVSS 4.0 base scores, matched by the NetScaler CNA records. The official impact wording for the memory flaws is "unpredictable or erroneous behavior or Denial of Service." The bulletin does not describe remote code execution, and the CVSS 4.0 impact metrics do not imply it.

CVE-2026-120868 (CVSS 4.0 9.3, CWE-119). "Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service." Citrix's precondition is "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)." Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L.

CVE-2026-107412 (CVSS 4.0 9.5, CWE-119). "Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service." It applies when "NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server." Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.

By our count of the official table, nine of the 28 rows score 9.0 or higher (Critical under CVSS 4.0):

The other 19 rows score from 6.9 to 8.7. Most are memory overflows tied to features such as SAML, WebAuth, LDAP, or certificate authentication, HTTP/2, HTTP/3 (QUIC), Application Firewall, GSLB, or BGP. One row matters for exposure: CVE-2026-120863 (8.7), a management-plane memory overflow that requires an attacker on an untrusted host to "reach the NetScaler appliance's NSIP or NSIP6 address." The one non-memory row, CVE-2026-111338 (6.9), writes sensitive authentication material to a local log file.

Citrix credits researchers including JPMorgan Chase's XOR team and watchTowr, and says its own team found "several vulnerabilities through advanced AI-assisted code analysis."

Corrected identifiers. A 12 November 2026 changelog entry in CTX697305 fixes a typo in seven CVE numbers: the bulletin now lists CVE-2026-111333 through CVE-2026-111339, and CVE-2026-111340 through CVE-2026-111342 are unchanged. The initially published CVE-2026-111343 through CVE-2026-111349 are not NetScaler flaws; on CVE.org and NVD they are unrelated October 2026 VulnCheck records for other products. The NetScaler ADM security advisory dashboard still showed the pre-correction identifiers on 13 November. This advisory follows the bulletin.

CVE.org and NVD. The NetScaler CNA has published CVE.org records for all 28 CTX697305 identifiers, each with the bulletin's CVSS 4.0 score and vector. NVD had received 24 of them, carrying the CNA score as a Secondary metric; CVE-2026-120864 through CVE-2026-120867 were not yet in NVD. NVD has not published its own Primary score for any ID in this bulletin.

Separate products, same day. Citrix published three other bulletins on 12 November:

• CTX697320: NetScaler Console CVE-2026-120869, where "an unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance." The fix is in Console 14.1-74.34 and later. The bulletin scores it CVSS 4.0 9.4 with an adjacent-network vector (AV:A). The CVE.org record published by the NetScaler CNA lists 9.3 with a network vector (AV:N). NVD (Awaiting Analysis) shows the CNA's 9.3 as a Secondary score. We report both until Citrix reconciles them. Headlines about an "authentication bypass" refer to this Console flaw, not the ADC and Gateway rows.
• CTX697280 and CTX697281: Secure Access Client local privilege escalation. CVE-2026-118268 on Windows (to SYSTEM) is fixed in 26.11.1.6 and later. CVE-2026-118269 on Linux (to root) is fixed in 26.10.4 and later. Both are CVSS 4.0 8.5 with a local vector. Neither identifier had a CVE.org or NVD record on 13 November.

Affected Product Versions

The versions below are from CTX697305. The bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway.

Citrix also notes that "Secure Private Access Hybrid deployments using NetScaler instances are also affected." Per the bulletin, "Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates."

Workaround and Mitigation

The official remediation is the fixed builds above. CTX697305 describes no workaround that substitutes for the upgrade, and we do not invent one.

1. Upgrade every customer-managed NetScaler ADC and Gateway appliance to a fixed build. CVE-2026-120868 applies in the default configuration, so feature checks do not remove an appliance from scope.
2. Prioritize Gateway and AAA virtual servers. These internet-facing paths are where CVE-2026-107412 (9.5), CVE-2026-111334, and CVE-2026-120864 apply.
3. Upgrade NetScaler instances behind Secure Private Access Hybrid, plus Console and Secure Access Clients under their own bulletins.
4. Keep NSIP and NSIP6 off untrusted networks (CVE-2026-120863). This is Rescana guidance, not a Citrix workaround. Verify the installed build after upgrading.

Indicators of Compromise

In its security updates blog, Citrix says it "is not releasing any IoCs for the announced vulnerabilities" and that, "As of the publication of this blog, Citrix is not aware of any unmitigated exploits for any of the announced vulnerabilities." That statement is not in the CTX697305 bulletin text. We do not invent IoCs.

Unexplained crashes or reboot loops on unpatched builds are worth investigating, but are not by themselves evidence of exploitation.

What to Ask Your Suppliers Today

NetScaler Gateway is an internet-facing remote-access service, and earlier NetScaler flaws such as CitrixBleed (CVE-2023-4966) were exploited and added to CISA KEV. That history is context, not evidence about this bulletin, which has no reported exploitation or KEV listing. Ask suppliers and managed service providers that run NetScaler:

1. Do you run customer-managed NetScaler ADC or NetScaler Gateway, including instances behind Secure Private Access Hybrid?
2. Have you upgraded to a fixed build (14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, or 13.1-37.293 FIPS/NDcPP, or later)? Ask for the installed build, not a yes or no.
3. If not, when will you? Ask for a named owner and a date.
4. Is the management interface (NSIP) reachable from untrusted networks, and are Console and Secure Access Clients patched?

Track incomplete answers to closure.

Need help working through remote-access and application-delivery suppliers exposed to the November 2026 NetScaler ADC and Gateway bulletin? Our team can help you prioritize them and track their answers. Talk to an expert

Sources

• Citrix CTX697305: NetScaler ADC and NetScaler Gateway Security Bulletin: primary source; Initial Publication 2026-11-12; changelog typo fix 2026-11-12.
• Citrix CTX697320: NetScaler Console Security Bulletin for CVE-2026-120869
• Citrix CTX697280: Secure Access Client for Windows (CVE-2026-118268)
• Citrix CTX697281: Secure Access Client for Linux (CVE-2026-118269)
• NetScaler ADM security advisory dashboard: supported CVEs: still listed the pre-correction identifiers on 13 November 2026, 10:24 Asia/Jerusalem UTC+2.
• CVE.org record for CVE-2026-120868: NetScaler CNA, published 13 November 2026, 01:39 Asia/Jerusalem UTC+2; 9.3, matches the bulletin.
• CVE.org record for CVE-2026-107412: NetScaler CNA, published 13 November 2026, 04:21 Asia/Jerusalem UTC+2; 9.5, matches the bulletin.
• CVE.org record for CVE-2026-120869: published 12 November 2026, 16:03 Asia/Jerusalem UTC+2; CNA 9.3 AV:N versus bulletin 9.4 AV:A.
• Citrix Community security updates blog (12 November 2026): vendor IoC FAQ; last updated 12 November 2026 (Pacific time).
• NVD API (CVE-2026-120868 and the other bulletin IDs): checked 13 November 2026, 10:24–10:27 Asia/Jerusalem UTC+2. 24 of 28 Received with the CNA score as Secondary; CVE-2026-120864 through CVE-2026-120867 not yet listed; no NVD Primary score.
• CISA KEV (JSON feed): catalogVersion 2026.11.10, dateReleased 2026-11-10T19:03:29.8375Z (21:03:29 Asia/Jerusalem UTC+2 on 10 November), sha256 41c8091ad62d508d6f8906ad5cd26b20efe551f7d51b95ecc8a6981fa640b4ea, 1,779 entries, checked 13 November 2026 at 10:23 Asia/Jerusalem UTC+2. None of these CVEs is listed.