Citrix’s November 12 security bulletin lists 28 vulnerabilities affecting NetScaler ADC and NetScaler Gateway, appliances that have also faced earlier password-spray attacks and exploitation of the CitrixBleed vulnerability.
The most broadly applicable, CVE-2026-120868 (CVSS 9.3), is a memory-overflow flaw in packet processing that affects all deployments, including default configurations, and can cause unpredictable behavior or denial of service. It does not require authentication or a special feature, according to CERT-EU’s advisory.
A second CVE, CVE-2026-107412 (CVSS 9.5), covers several memory-overflow vulnerabilities affecting appliances configured as Gateway or AAA virtual servers and can be reached without authentication. The remaining issues involve configurations or features such as SAML, WebAuth, LDAP, Email OTP, client-certificate authentication, DNS-over-HTTPS, HTTP/2, HTTP/3, SMPP, RTSP, BGP routing and the Application Firewall. Citrix said it was not aware of exploitation of the announced vulnerabilities, and CERT-EU said no public proof-of-concept had been confirmed.
The fixed releases are NetScaler ADC and Gateway 14.1-73.57 or later, 13.1-64.39 or later, ADC FIPS 14.1-73.58 FIPS or later, and ADC FIPS/NDcPP 13.1-37.293 or later. Citrix said all managed cloud services covered by the release have already been upgraded; the bulletins apply to customer-managed deployments.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
