NetScaler’s November Fix Batch, by the Numbers: Nine Critical Gateway Bugs, a Console Login Bypass and an Update Checklist
Citrix has patched nine critical memory flaws in NetScaler ADC and Gateway, an authentication bypass in NetScaler Console and privilege-escalation bugs in its Secure Access Client. None are known to be exploited yet. Here is the spec sheet and a checklist for updating.
Citrix has released a large set of security fixes for NetScaler, the appliance many organizations use to publish remote access, VPN and load-balanced applications to the internet. The company says it is not aware of any exploits. But NetScaler bugs have repeatedly been targeted soon after disclosure, so these updates are worth scheduling now rather than waiting.
The spec sheet below is compiled from The Hacker News’ breakdown of the Citrix bulletins and SecurityWeek’s coverage. Always confirm the details against Citrix’s own bulletins before you act.
Spec sheet: NetScaler ADC and NetScaler Gateway
- Scale: SecurityWeek counts 28 vulnerabilities in ADC and Gateway, nine of them critical. Most of the rest are high severity with similar effects.
- Type of bug: The critical ones are memory overflow or memory corruption flaws that can cause unpredictable behavior or a denial of service, meaning the appliance stops serving traffic.
- Exposure depends on configuration. One affects every deployment. The others apply only when a particular feature is set up:
- CVE-2026-120868 (CVSS 9.3): packet processing. All ADC and Gateway deployments.
- CVE-2026-107407 (9.3): SMPP traffic. Load balancing or content switching virtual servers of type SMPP.
- CVE-2026-107408 (9.3): DNS and DNS-over-HTTPS. DNS load balancing with recursive resolution.
- CVE-2026-107409 (9.3): DNS-over-HTTPS. DNS load balancing over HTTPS.
- CVE-2026-107410 (9.3): NetScaler Push. Load balancing virtual servers of type PUSH.
- CVE-2026-107412 (9.5): several memory overflows. Appliances configured as a Gateway or AAA virtual server.
- CVE-2026-107415 (9.3): Email OTP authentication. Setups using an Email Action.
- Endpoint Analysis (EPA/EPAS) memory overflow (9.3): VPN or AAA virtual servers with Endpoint Analysis. The two outlets print slightly different CVE numbers for this one, so check Citrix’s bulletin for the exact identifier.
- CVE-2026-120864 (9.3): ICA proxy. Gateway VPN, AAA, or CR virtual servers of type HDX.
SecurityWeek also points to a medium-severity bug, CVE-2026-111338, that leaves sensitive authentication material in a log file.
Fixed builds: 14.1-73.57 and later; 13.1-64.39 and later releases of 13.1; 14.1-FIPS 14.1-73.58 and later; 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later.
Spec sheet: the other products
- NetScaler Console, CVE-2026-120869 (CVSS 9.4): an improper authentication flaw that could let an unauthenticated attacker get around login controls and reach restricted resources. It affects 14.1 releases before 14.1-74.34, which is the fixed version.
- Secure Access Client for Windows, CVE-2026-118268 (8.5): a low-privileged user could escalate to SYSTEM. Fixed in 26.11.1.6 and later.
- Secure Access Client for Linux, CVE-2026-118269 (8.5): a low-privileged user could gain root. Fixed in 26.10.4 and later.
Background: Citrix says the fixes came out of a deeper review of its code that included AI-assisted analysis, aimed at hardening the products before attackers found the same problems.
Update checklist
- List every NetScaler ADC, Gateway and Console instance you own or that a provider runs for you, along with its current build.
- Note which features each one uses (Gateway/VPN, AAA, Email OTP, Endpoint Analysis, DNS, HDX/ICA proxy) to see which bugs apply. Plan to patch everything anyway, since packet processing affects all deployments.
- Update internet-facing gateways first, in a maintenance window, with a tested rollback plan and a recent configuration backup.
- Update NetScaler Console, and make sure its management interface is reachable only from admin networks.
- Push the updated Secure Access Client to Windows and Linux endpoints through your normal software deployment process.
- After updating, check that remote users can still sign in and that load-balanced applications respond normally.
- Check what your appliance logs record and who can read those log files, given the bug that exposes authentication material in logs.
What this means for your company
If remote staff connect through a NetScaler gateway, or a hosting provider runs one for you, this batch matters even with no attacks reported yet. A denial-of-service bug on the box that carries your remote access can shut your workforce out. Remote-access appliances in general have been frequent targets this year. Whatever brand you run, the habits are the same: keep an up-to-date inventory, know who applies fixes and how fast, keep management interfaces off the open internet, and update client software on laptops along with the appliance.
Not sure whether your remote-access gateway is on a fixed build, or who is responsible for updating it? We can help sort that out. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
