Vulnerabilities

Citrix patches 28 NetScaler flaws, one hitting every default install

Citrix bulletin CTX697305 fixes 28 NetScaler ADC and Gateway memory flaws, including CVE-2026-120868, which hits every default install. Patch now.

Server illustration with the headline 28 NetScaler flaws, one hits every install

Citrix has fixed 28 memory-safety bugs in NetScaler ADC and NetScaler Gateway, and one of them affects every appliance in its out-of-the-box configuration. Nothing is known to be exploited yet, but NetScaler’s record this year suggests UK teams should treat this as an emergency change, not a routine one.

What happened

On 12 November 2026, Cloud Software Group published security bulletin CTX697305 for customer-managed NetScaler ADC and NetScaler Gateway. The bulletin lists 28 CVEs: nine are rated critical, fifteen high and four medium under CVSS v4.0. Nearly all are memory handling errors: buffer and heap overflows, out-of-bounds writes and one double free.

Two entries stand out. CVE-2026-120868, scored 9.3, sits in core packet processing, and Citrix says it applies to all deployments with no extra feature required. CVE-2026-107412, scored 9.5 and the highest in the batch, groups several overflows that hit appliances in the Gateway role (SSL VPN, ICA Proxy, CVPN, RDP Proxy) and AAA virtual servers.

Citrix released a companion bulletin at the same time for NetScaler Console, the central management product. It fixes CVE-2026-120869, an authentication bypass that SecurityOnline reports is scored 9.4. CERT-EU issued its own advisory later that day, urging organisations to upgrade every customer-managed appliance and to start with internet-facing Gateway and AAA systems.

According to CERT-EU and Beazley Security, Citrix reports no exploitation and no confirmed public proof of concept. Researchers at watchTowr, Capital One Offensive Security and JPMorgan Chase’s XOR team are credited, and Citrix says AI-assisted code analysis by its in-house team uncovered a number of the others.

The technical picture

The fixed builds are 14.1-73.57 for the 14.1 branch and 13.1-64.39 for 13.1. FIPS customers need 14.1-73.58 FIPS, while the 13.1 FIPS and NDcPP variants need 13.1-37.293. NetScaler Console needs 14.1-74.34 or later. The 12.1 and 13.0 branches are unsupported and will stay vulnerable. Secure Private Access hybrid deployments that rely on customer-managed NetScaler instances are also in scope. Citrix has already patched the services it hosts itself.

Citrix describes the impact of most of these flaws in modest terms, warning of “unpredictable or erroneous behavior” or a crash. Read that wording with care. For CVE-2026-120868 and several others, the published CVSS vectors rate the confidentiality, integrity and availability impact as high, and they require no privileges and no user interaction. Beazley points out that this means the vendor is not ruling out outcomes beyond a crash. In practice, a memory overflow in a network-facing C codebase is a common route to remote code execution, once someone has studied the patch closely.

The other critical items depend on configuration. They include SMPP, NetScaler Push, DNS and DNS-over-HTTPS load balancing, Email OTP authentication, Endpoint Analysis and the ICA proxy. The high-rated set covers SAML, WebAuth, LDAP, client-certificate and knowledge-based authentication, as well as HTTP/2, HTTP/3, GSLB, RADIUS, Diameter, MQTT and the Application Firewall. CVE-2026-120863 can be reached through the management address (NSIP) by an attacker on an untrusted host. CVE-2026-120866 affects BGP and needs the attacker to be, or spoof, a configured neighbour. A medium-rated issue, CVE-2026-111338, writes authentication material into httperror.log.

Citrix offers no workaround. Because CVE-2026-120868 needs no particular feature, upgrading is the only real fix. The bulletin does give configuration patterns that let administrators check which of the feature-dependent CVEs also apply to them.

Checklist of six NetScaler patching priorities for Citrix bulletin CTX697305, from inventory to threat hunting

Why it matters for UK organisations

NetScaler Gateway is a standard way into UK networks. You find it in front of Citrix virtual desktops at NHS trusts, local authorities, law firms, universities and financial services firms. That makes any unauthenticated flaw on the device a national problem, not a niche one.

This year’s history makes the point. In August, Citrix fixed authentication bypass CVE-2026-19490. On 10 September NHS England Digital raised its alert to high after exploitation was seen in the wild, and its National CSOC judged further exploitation “almost certain”. A few weeks before that, on 17 August, NHS England had escalated a separate NetScaler memory overflow, CVE-2026-8452, after proof-of-concept code was followed by exploitation attempts against honeypots. Citrix then fixed two actively exploited zero-days in October. SecurityOnline counts six 2026 NetScaler CVEs added to CISA’s Known Exploited Vulnerabilities catalogue between March and October.

The pattern is consistent: a bulletin, a patch diff, a proof of concept, then mass scanning, often within days. Under the NCSC’s guidance on vulnerability management, internet-facing edge devices with critical flaws should be patched as soon as possible. Cyber Essentials expects high and critical fixes to be applied within 14 days. Applying these fixes faster than that is entirely reasonable.

Expert view

In my experience, NetScaler estates fall behind for three predictable reasons. Upgrades are treated as change-board events with maintenance windows weeks away. HA pairs and FIPS builds make rollouts fiddly. And nobody owns the legacy 13.0 box that still terminates a supplier VPN. All three apply here.

The lack of reported exploitation is not reassuring. Patches for appliances like this are diffed quickly, and a bug that needs no configuration is the obvious first target. Low “denial of service” wording has fooled defenders before. Plan for remote code execution being demonstrated, and if it never is, count that as luck.

I would also pay attention to the Console fix. A central management platform that holds admin access to the whole NetScaler fleet is a valuable target. CVSS scores CVE-2026-120869 as reachable from an adjacent network, which limits it if Console sits on a properly isolated management segment. When we test, it often does not.

Finally, AI-assisted code review turned up part of this batch. That cuts both ways. Vendors are finding more bugs in old codebases, and attackers have the same tools to turn patches into exploits faster.

What to do now

  1. Inventory first. List every NetScaler ADC, Gateway and Console instance, including DR, test and supplier-hosted units, and record its build. Anything below 14.1-73.57 or 13.1-64.39 is exposed to CVE-2026-120868.
  2. Start with internet-facing Gateway and AAA appliances, then internal ADCs, then Console (14.1-74.34). This maps to the Cyber Essentials security update management control.
  3. Retire 12.1 and 13.0. They will not be fixed. Migrate them to a supported 14.1 build or take them off the internet.
  4. Lock down management. Keep NSIP addresses and Console reachable only from a dedicated admin network, in line with the Cyber Essentials firewall and secure configuration controls.
  5. Hunt as you patch. Given this year’s webshell campaigns against NetScaler, check appliances for unexpected files, new accounts and unusual outbound connections before declaring them clean.
  6. Rotate credentials where relevant. Because of CVE-2026-111338, review who can read httperror.log and consider rotating sessions and secrets on shared appliances.
  7. Watch for escalation. Monitor the NCSC, NHS England Digital cyber alerts and the CISA KEV catalogue for these CVE IDs, and shorten timelines further if exploitation is reported.

Bottom line

CTX697305 is a large, mostly unglamorous batch of memory bugs, but one of them hits every NetScaler as shipped and another hits the Gateway role most UK organisations expose. Nobody is known to be exploiting them yet. Given this platform’s record in 2026, plan your patching on the assumption that exploitation could start within days.

Sources

Related Posts