If your NetScaler appliances are already locked down, there’s still a reason to check their builds. Citrix’s November update fixes a packet-processing flaw that affects default ADC and Gateway configurations. A second bulletin fixes an authentication bypass in the customer-managed Console.
Published by Citrix November 12, 2026. Last verified November 13, 2026 (UTC). Both bulletins are rated Critical by Citrix. Suggested MSP priority: Expedite customer-managed internet-facing ADC and Gateway appliances and any Console reachable from untrusted networks. Include private appliances in the rollout.
What changed
November 12, 2026 bulletin correction. Citrix replaced CVE-2026-111343 through CVE-2026-111349 with CVE-2026-111333 through CVE-2026-111339, in the same order. The affected configurations, CVSS scores and fixed builds stayed the same. Use the corrected IDs in tickets and scan exceptions, then verify remediation against the installed build.
- CTX697305 · NetScaler ADC and Gateway. CVE-2026-120868 (CVSS 4.0 9.3) is a memory overflow in default packet processing that can disrupt service. CVE-2026-107412 (9.5) requires Gateway or AAA, and CVE-2026-120864 (9.3) applies to ICA proxy on specified virtual servers. Include NetScaler instances used by Secure Private Access Hybrid.
- CTX697320 · NetScaler Console. CVE-2026-120869 (CVSS 4.0 9.4) allows unauthenticated access to restricted resources if the attacker can reach the Console IP. The vendor’s CVSS vector rates the attack path as adjacent.
Citrix said it was unaware of unmitigated exploits when it published the release and issued no indicators of compromise. None of the listed CVEs appeared in CISA KEV at verification, so there is no associated federal due date. The bulletins provide patch guidance and specify no workaround or credential rotation. Citrix says it has already upgraded the covered managed services, including Secure Private Access, Gateway Service, Adaptive Auth and NetScaler Console Service.
Affected and fixed builds
| Customer-managed product | Affected releases | Fixed build or later in branch |
|---|---|---|
| ADC / Gateway 14.1 | Before 14.1-73.57 | 14.1-73.57 |
| ADC / Gateway 13.1 | Before 13.1-64.39 | 13.1-64.39 |
| ADC 14.1 FIPS | Before 14.1-73.58 FIPS | 14.1-73.58 FIPS |
| ADC 13.1 FIPS / NDcPP | Before 13.1-37.293 | 13.1-37.293 |
| Console 14.1 | Before 14.1-74.34 | 14.1-74.34 |
The bulletin’s standard 14.1 minimum is 73.57. Citrix lists 73.58 in the ADC download catalog. Choose the supported image for your deployment and license.
MSP rollout
- Inventory each tenant’s ADC, Gateway and Console builds, license type, HA peers and hybrid instances. Use NetScaler Console’s version scan and review VPN, AAA and management reachability.
- Restrict Console and appliance management IPs to trusted admin paths where reachable from untrusted networks. This reduces exposure to management-plane issues. The ADC and Gateway packet-processing fix still requires an upgrade.
- Upgrade ADC and Gateway first, then Console. Citrix says existing ICA sessions end during the upgrade. A pre-14.1-51.x Console with a legacy file-based pooled or flexed license and no extension can be blocked. Follow Citrix’s License Activation Service exception sequence before upgrading that Console.
- Confirm builds on both HA peers and the Console. Re-run the version scan and check HA sync, licensing, Gateway sign-in, fresh ICA sessions and health of services behind the appliances.
ADC and Gateway applicability by CVE
The table follows the corrected CTX697305. The NetScaler Console supported-CVE list still showed the superseded numbers at verification. Match any older scanner or Console findings against the corrected IDs, appliance build and configuration before closing remediation tickets. Separate CVE Program records for the seven corrected numbers were unavailable at verification.
| Citrix-listed ID | CVSS 4.0 | Configuration or access |
|---|---|---|
| CVE-2026-120868 | 9.3 | Default ADC or Gateway packet processing. No additional feature required. |
| CVE-2026-107412 | 9.5 | Gateway configured for SSL VPN, ICA Proxy, CVPN or RDP Proxy, or an AAA virtual server. |
| CVE-2026-120864 | 9.3 | Gateway VPN, AAA or HDX content-redirection virtual server. |
| CVE-2026-120863 | 8.7 | NetScaler management address (NSIP or NSIP6) reachable from an untrusted host. |
| CVE-2026-107407 | 9.3 | SMPP load-balancing or content-switching virtual server. |
| CVE-2026-107408 | 9.3 | DNS load balancing and recursive DNS resolution. |
| CVE-2026-107409 | 9.3 | DNS load balancing over HTTPS. |
| CVE-2026-107410 | 9.3 | PUSH load-balancing virtual server. |
| CVE-2026-107411 | 8.7 | RTSP load-balancing virtual server or RTSP ALG enabled on an LSN group. |
| CVE-2026-107413 | 8.7 | SAML action. |
| CVE-2026-107414 | 8.7 | WebAuth action. |
| CVE-2026-107415 | 9.3 | Email authentication action. |
| CVE-2026-111340 | 8.7 | LDAP action with KBAttribute or an email action. |
| CVE-2026-111341 | 8.7 | Client certificate authentication action. |
| CVE-2026-111342 | 8.7 | Gateway configured for SSL VPN, ICA Proxy, CVPN or RDP Proxy, or an AAA virtual server. |
| CVE-2026-111333 | 6.9 | Gateway configured for SSL VPN, ICA Proxy, CVPN or RDP Proxy, or an AAA virtual server. |
| CVE-2026-111334 | 9.3 | VPN or AAA virtual server with Endpoint Analysis. |
| CVE-2026-111335 | 6.9 | ADC or Gateway reachable on the data path. Citrix describes a potential reboot loop. |
| CVE-2026-111336 | 8.3 | HTTP/SSL virtual server with HTTP/2 enabled in its HTTP profile. |
| CVE-2026-111337 | 8.7 | Globally or virtually bound B64DECODE policy, or Application Firewall configured. |
| CVE-2026-111338 | 6.9 | Local read access to the HTTP error log after a logout. Citrix reports sensitive authentication material in the log. |
| CVE-2026-111339 | 6.9 | Application Firewall profile with one of the affected inspection protections listed in the bulletin. |
| CVE-2026-120860 | 8.7 | Diameter, SIP-over-TCP, MQTT or RADIUS load-balancing virtual server. |
| CVE-2026-120861 | 8.7 | GSLB with MEP, static proximity, a geolocation responder policy or automatic configuration sync. |
| CVE-2026-120862 | 8.7 | SIP ALG on an LSN group or DNS answer-section security logging. |
| CVE-2026-120865 | 8.7 | HTTP_QUIC load-balancing or content-switching virtual server. |
| CVE-2026-120866 | 7.7 | Dynamic BGP with a configured neighbor without TCP-MD5. The attacker must be or be able to spoof that neighbor. |
| CVE-2026-120867 | 8.7 | TLS 1.3 virtual server with an ECH profile or SSL virtual server with a bound SafeNet HSM key. |