Ing. Calogero Bono
On November 12, 2026, the ACN published an alert about the security updates Citrix released for NetScaler ADC, NetScaler Gateway, NetScaler Console, Secure Access Client and App Layering. The fixed vulnerabilities are many, 10 rated critical and 15 rated high. Some allow bypassing authentication, others can take the service offline. If you use NetScaler for remote access or load balancing, it is worth checking the installed version right away.
A few terms before we get into the facts. NetScaler ADC is the appliance that distributes traffic to servers. Gateway is the component that manages remote access. CVSS is the score from 0 to 10 that measures how severe a flaw is. DoS (denial of service) indicates an attack that makes the service unavailable. Authentication bypass means getting around the login check.
What did Citrix release?
According to the ACN alert, Citrix published updates for multiple vulnerabilities in the NetScaler ADC, NetScaler Gateway, NetScaler Console, Secure Access Client and App Layering products. The agency lists four types of risk – arbitrary code execution, authentication bypass, denial of service and privilege escalation.
According to The Hacker News, the detailed defects number 12, across NetScaler and Secure Access Client. The ACN instead counts 25 critical and high issues, and excludes third-party components from the list.
Which critical flaws affect NetScaler ADC and Gateway?
Almost all are overflows or memory corruptions that can cause unpredictable behavior or DoS. The CVSS score is 9.3 for most, with CVE-2026-107412 at 9.5.
The important point is the configuration. Only CVE-2026-120868, in Packet Processing, affects all installations. The others depend on how the appliance is set up.
- SMPP, with virtual servers of that type.
- DNS and DNS-over-HTTPS, with load balancing or recursive resolution.
- NetScaler Push, Email OTP and Endpoint Analysis.
- Gateway or AAA virtual servers, and ICA proxy.
What changes for NetScaler Console and Secure Access Client?
CVE-2026-120869, score 9.4, affects NetScaler Console. An unauthenticated attacker could bypass controls and access reserved resources of the appliance. The fix is in 14.1-74.34.
On the client side, CVE-2026-118268 allows a low-privileged user to reach SYSTEM on Windows. CVE-2026-118269 allows obtaining root privileges on Linux. Both have a score of 8.5 and are fixed in versions 26.11.1.6 and 26.10.4.
Which versions should be installed?
For NetScaler ADC and Gateway you need 14.1-73.57 or later and 13.1-64.39 or later. For ADC FIPS 14.1, 14.1-73.58 FIPS. For ADC FIPS and NDcPP 13.1, 13.1-37.293.
The ACN also indicates NetScaler Console 14.1-74.34, Secure Access Client for Windows 26.11.1.6, for Linux 26.10.4, and App Layering 2603.9. The agency reminds readers that the products are vulnerable only under the conditions described in the vendor's bulletins, which should therefore be read.
To go further, read Xen Orchestra, Vates detects in-the-wild exploitation of two vulnerabilities and the ACN urges updates and Wazuh, the ACN reports public PoCs for 8 vulnerabilities and urges an update to 4.14.9.
Limits to know
Some details are missing. The ACN source does not report the full list of CVEs here, and The Hacker News describes only some of them. Citrix states it is not aware of exploits for the announced flaws, but that is the company's claim and we have not verified it. We do not know whether the situation will change once technical details are published.
What changes for those working in digital
If you manage NetScaler, check the version and configuration. Many flaws affect specific functions, so knowing which services you have enabled helps set priorities. Appliances exposed to the Internet, such as Gateway and AAA virtual servers, should be updated first. Do not forget the clients installed on employees' PCs. Those who entrust servers to a provider, for example through managed hosting with security updates, should ask for confirmation that the patch was applied. You also need a plan for restarts, because remote access may be interrupted.
Our take
The most interesting point is the method. According to The Hacker News, Citrix attributes the fixes to a code review with AI-assisted analysis. If so, the tool finds defects before attackers do, and that is a good thing. But such a large batch also shows how much old code had to be checked. For customers the arithmetic is simple – more patches to apply. The advice bears repeating – do not leave consoles and gateways reachable from the whole network without need.
Frequently asked questions
Are the Citrix vulnerabilities already being exploited?
Citrix states it is not aware of any exploits. That is the company's statement. Do not wait for confirmation, update anyway.
How many vulnerabilities did Citrix fix?
According to the ACN, 10 critical and 15 high. The Hacker News describes 12 in detail. The difference depends on what is counted and on the sources.
Which flaw is the most serious?
By score, CVE-2026-107412 with 9.5 on NetScaler configured as Gateway or AAA. Next is CVE-2026-120869 with 9.4 on NetScaler Console, an authentication bypass.
Do I need to update the clients too?
Yes, if you use Secure Access Client. Two flaws rated 8.5 allow obtaining SYSTEM privileges on Windows or root on Linux. You need versions 26.11.1.6 and 26.10.4.
Where can I find the official instructions?
In Citrix's security bulletins, referenced by the ACN alert. There you will find the exact conditions under which each product is vulnerable.
What to watch for in the coming weeks on NetScaler
After the patch comes the phase in which attackers study the fixes. It is wise to stay alert.
- Check whether technical details or public exploits appear for these CVEs, including in new ACN updates.
- Review logs for unusual attempts against Gateway, AAA and Console in the days before the patch.
- Record the installed versions of every appliance and client for your next update window.
