Citrix NetScaler Critical Vulnerabilities Fixed in 14.1-73.57 and 13.1-64.39

TL;DR

Cloud Software Group has released four Citrix security bulletins that fix 31 CVEs. Most of the new Citrix NetScaler vulnerabilities sit in NetScaler ADC and NetScaler Gateway, which receive fixes for 28 memory flaws. One of them, CVE-2026-120868, affects every deployment, even with the default configuration. The other bulletins cover NetScaler Console and the Secure Access Client for Windows and Linux.

NetScaler ADC and Gateway 14.1-73.57 and 13.1-64.39 fix 28 memory flaws rated up to CVSS 9.5. NetScaler Console 14.1-74.34 fixes a 9.4 authentication bypass, and new Secure Access Client builds fix two local privilege escalation bugs. Citrix reports no exploitation, and no public proof-of-concept has been confirmed.

Notable CVEs

Why It Matters

NetScaler appliances usually sit at the network edge. They handle VPN access, load balancing and single sign-on, so attackers can often reach them from the internet. That exposure has made them a frequent target.

Attackers have already exploited Citrix NetScaler vulnerabilities this year. CISA’s Known Exploited Vulnerabilities catalog added six NetScaler CVEs from 2026 between March and October. None of the new CVEs appear in that catalog yet.

The default-configuration bug raises the stakes. The NetScaler ADC and Gateway bulletin says it plainly: “All NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration.” In other words, admins cannot rule out exposure by reviewing their features.

How the Attack Works

NetScaler ADC and Gateway

Most of the 28 bugs are memory overflows in the code that parses network traffic. Citrix uses the same wording for nearly all of them. Each flaw “can lead to unpredictable or erroneous behavior or Denial of Service.”

CVE-2026-120868 sits in core packet processing and carries a CVSS 4.0 score of 9.3. It needs no special feature and no login. CVE-2026-107412 scores highest, at 9.5. It covers several memory overflows that affect appliances set up as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or an AAA virtual server.

The remaining bugs depend on specific features. These include SAML, WebAuth, LDAP, Email OTP and client-certificate login. Others hit DNS-over-HTTPS, HTTP/2, HTTP/3 (QUIC), SMPP, RTSP, BGP routing and the Application Firewall.

Several scores point beyond a simple crash. Ten flaws have a high impact on confidentiality, integrity and availability. However, the bulletin describes only unpredictable behavior and denial of service. It does not claim code execution.

Local and Logging Issues

A few bugs need local access. For instance, CVE-2026-111348 writes “sensitive authentication material” to a log file on the appliance. An attacker with local read access to that log could collect it.

NetScaler Console

CVE-2026-120869 scores 9.4. According to the NetScaler Console bulletin, “An unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance.” The attacker only needs access to the Console IP address. The CVSS vector marks the attack as adjacent-network, not internet-wide.

Secure Access Client

Both client flaws score 8.5 and stem from improper privilege management. On Windows, CVE-2026-118268 lets “a low-privileged user” escalate to SYSTEM. On Linux, CVE-2026-118269 lets the same kind of user “gain root access.” Each attack requires a standard account on the machine.

Affected Versions

NetScaler ADC and Gateway

• 14.1 before 14.1-73.57
• 13.1 before 13.1-64.39
• NetScaler ADC FIPS before 14.1-73.58 FIPS
• NetScaler ADC FIPS and NDcPP before 13.1-37.293

Secure Private Access hybrid deployments that use NetScaler instances are also affected. Meanwhile, Citrix-managed cloud services and Adaptive Authentication receive updates from Cloud Software Group directly.

Console and Clients

• NetScaler Console 14.1 before 14.1-74.34
• Secure Access Client for Windows before 26.11.1.6
• Secure Access Client for Linux before 26.10.4

Patch and Mitigation

Cloud Software Group “strongly urges affected customers” to install the fixed builds “as soon as possible.” The bulletins list no workaround, so upgrading is the only fix.

Fixed Builds

• NetScaler ADC and Gateway 14.1-73.57, 13.1-64.39 and later
• NetScaler ADC 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP
• NetScaler Console 14.1-74.34
• Secure Access Client for Windows 26.11.1.6, per the Windows client bulletin
• Secure Access Client for Linux 26.10.4, per the Linux client bulletin

Next Steps for Admins

Patch internet-facing Gateway and AAA appliances first, since CVE-2026-120868 and CVE-2026-107412 can reach them without a login. Next, restrict NetScaler Console so that only trusted management hosts can reach it.

The ADC bulletin also lists configuration checks for each feature-dependent CVE. Teams can use them to judge exposure while they schedule upgrades. Still, the default-configuration flaw means every customer-managed appliance needs the update. Finally, watch for CISA KEV additions, given this year’s record of exploited Citrix NetScaler vulnerabilities.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of Daily CyberSecurity. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.