Citrix NetScaler Vulnerabilities November 2026 Explained: 31 Flaws Patched, 9.5 Severity and the Builds to Install

Illustrative image: a data centre server room. Image: Wikimedia Commons / Fleshas, CC BY-SA 3.0.

TL;DR: The Citrix NetScaler vulnerabilities November 2026 explained in this post are 31 flaws Citrix fixed on 12 November 2026 across four security bulletins, with scores up to 9.5. One flaw hits every NetScaler ADC and Gateway deployment, even with the default configuration. No exploitation has been confirmed, but there is no workaround — update to 14.1-73.57 or 13.1-64.39 now, starting with internet-facing gateways.

Key Highlights

• What: Citrix (Cloud Software Group) published four security bulletins on 12 November 2026 fixing 31 CVEs across NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client.
• Worst flaw: CVE-2026-107412, scored 9.5, covers multiple memory overflows affecting appliances set up as a Gateway or AAA virtual server.
• Default-config risk: CVE-2026-120868 (9.3) sits in core packet processing and affects all NetScaler ADC and Gateway deployments, including the default configuration.
• Exploitation: Citrix says it is not aware of any exploits for these flaws, and no public proof of concept has been confirmed. That is the window to patch — not a reason to wait.
• Fix: NetScaler ADC and Gateway 14.1-73.57 / 13.1-64.39 and later; NetScaler Console 14.1-74.34; Secure Access Client 26.11.1.6 (Windows) and 26.10.4 (Linux). No workaround exists.

Citrix NetScaler vulnerabilities November 2026 explained: the four bulletins

Citrix released the patches on 12 November 2026, after a deeper review of its codebase that used AI-assisted code analysis to find the flaws before attackers did. The headline count needs a short explanation, because two numbers are circulating. The Hacker News reports 12 flaws — the most serious ones across the four products. The full count is 31 CVEs: the NetScaler ADC and Gateway bulletin (CTX697305) alone fixes 28 memory-safety flaws, the NetScaler Console bulletin (CTX697320) fixes the authentication bypass, and two more bulletins cover the Secure Access Client for Windows and Linux. Of the 31, nine are rated Critical, 16 High and six Medium.

Most of the ADC and Gateway flaws are memory overflows in the code that parses network traffic. Citrix uses the same wording for nearly all of them: each can lead to "unpredictable or erroneous behavior or Denial of Service". The bulletin does not claim remote code execution for these flaws, and this post does not claim it either — but a denial-of-service flaw in a box that sits at the network edge is still a serious problem, because it can take down remote access, load balancing and single sign-on for everyone behind it.

The Console flaw is different in kind. CVE-2026-120869 (9.4) is an improper-authentication bug that lets an unauthenticated attacker bypass authentication controls and reach restricted resources on the appliance. It only needs access to the Console's IP address, and its CVSS vector marks the attack as adjacent-network rather than internet-wide — which is why restricting who can reach the Console matters as much as patching it.

Flaw	Score	What it does	Fixed in
CVE-2026-107412	9.5	Multiple memory overflows; Gateway or AAA virtual server	14.1-73.57 / 13.1-64.39
CVE-2026-120869	9.4	NetScaler Console authentication bypass, no login needed	Console 14.1-74.34
CVE-2026-120868	9.3	Memory overflow in packet processing; every deployment, default config included	14.1-73.57 / 13.1-64.39
CVE-2026-107407 / 107408 / 107409 / 107410 / 107415 / 111344 / 120864	9.3 each	Memory overflows in SMPP, DNS/DoH, Push, Email OTP, Endpoint Analysis and ICA proxy — only where those features are configured	14.1-73.57 / 13.1-64.39
CVE-2026-118268 (Windows) / CVE-2026-118269 (Linux)	8.5 each	Secure Access Client privilege escalation to SYSTEM / root	26.11.1.6 / 26.10.4

Illustrative image: rackmount network switches and patch panels. Image: Wikimedia Commons / Dsimic, CC BY-SA 4.0.

Why NetScaler flaws get treated as urgent

NetScaler appliances usually sit at the network edge. They handle VPN access, load balancing and single sign-on, so attackers can often reach them directly from the internet. That exposure has made them a frequent target: CISA's Known Exploited Vulnerabilities catalog added six NetScaler CVEs from 2026 between March and October, and NetScaler flaws have a long history of being exploited within days of disclosure. None of the new CVEs is in that catalog yet — but that is exactly the point. The catalog lists flaws attackers are already using; a patch released before exploitation is confirmed is the cheapest time to fix one.

The default-configuration flaw raises the stakes further. The ADC and Gateway bulletin states plainly that all NetScaler ADC and Gateway deployments are affected, including those deployed with the default configuration. Admins cannot rule out exposure by reviewing which features they turned on — CVE-2026-120868 needs no special feature and no login. The remaining flaws do depend on specific features, including SAML, WebAuth, LDAP, Email OTP, client-certificate login, DNS-over-HTTPS, HTTP/2, HTTP/3 (QUIC), SMPP, RTSP, BGP routing and the Application Firewall, and the bulletin lists configuration checks for each, so teams can judge their exposure while they schedule upgrades.

For Indian readers, the practical angle is straightforward. NetScaler gateways are common in Indian enterprises, IT services firms and managed service providers, where they front remote access for large workforces. A gateway outage or a Console compromise in that setup is not an abstract risk — it is a working day lost, or an attacker inside the perimeter. No Indian victim has been named in connection with these flaws, and this post does not claim one.

What to do now

Patch internet-facing Gateway and AAA appliances first, since CVE-2026-120868 and CVE-2026-107412 can reach them without a login. Then restrict NetScaler Console so only trusted management hosts can reach it, and patch it to 14.1-74.34. Update the Secure Access Client on employee laptops and desktops to 26.11.1.6 on Windows and 26.10.4 on Linux, because a low-privileged user on a shared machine could otherwise escalate to SYSTEM or root.

To check your build, open the NetScaler admin interface and compare the running version against the fixed builds: 14.1-73.57 or later on the 14.1 line, 13.1-64.39 or later on the 13.1 line, and 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP for FIPS builds. Citrix-managed cloud services and Adaptive Authentication receive updates from Cloud Software Group directly, so customers on those services do not need to act. Secure Private Access hybrid deployments that use NetScaler instances are also affected and need the same update.

There is no workaround. The bulletins list none, so upgrading is the only fix — and if an upgrade cannot happen immediately, the interim step is to reduce exposure: limit who can reach the appliance and turn off features that are not needed. Finally, watch for CISA KEV additions in the coming days: given this year's record of exploited NetScaler vulnerabilities, a KEV listing would shorten the patching window sharply.

Should you care?

✅ Yes — if you run NetScaler, patch this week. Nine critical flaws, one hitting every deployment by default, no workaround, and a product with a proven record of being exploited quickly. The absence of confirmed exploitation today is the reason to move now, while patching is still a planned change instead of an emergency. If you do not run NetScaler, there is nothing to do — but if your employer or client does, forward this to the team that manages it.

FAQs

What is the most severe Citrix NetScaler vulnerability in November 2026?
CVE-2026-107412, scored 9.5, is the highest-rated of the 31 flaws Citrix fixed on 12 November 2026. It covers multiple memory overflows affecting appliances configured as a Gateway or an AAA virtual server, and it can cause unpredictable behaviour or denial of service. It is fixed in NetScaler ADC and Gateway 14.1-73.57 and 13.1-64.39 and later.

Which NetScaler versions are affected by the November 2026 flaws?
NetScaler ADC and Gateway 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39, plus FIPS and NDcPP builds before their matching fixed versions. NetScaler Console before 14.1-74.34 is affected by the 9.4 authentication bypass, and the Secure Access Client before 26.11.1.6 on Windows and 26.10.4 on Linux is affected by the privilege-escalation flaws.

Have the Citrix NetScaler November 2026 flaws been exploited?
No. Citrix says it is not aware of any exploits for these vulnerabilities, and no public proof of concept has been confirmed. That is different from the product's history: CISA added six NetScaler CVEs from 2026 to its Known Exploited Vulnerabilities catalog between March and October, so defenders should patch before, not after, exploitation is confirmed.

How do I check my NetScaler version?
Open the NetScaler admin interface and read the running build, then compare it with the fixed builds — 14.1-73.57 or later on the 14.1 line, 13.1-64.39 or later on the 13.1 line. If the build is older, schedule the upgrade, and patch internet-facing Gateway and AAA appliances first.

Takeaway

Citrix found 31 flaws in its own edge appliances and fixed them before attackers were seen using them. The patch is free, the window is open, and the one flaw that needs no feature and no login means every customer-managed appliance is in scope. Check your build today.

For the wider pattern behind this patch, read our CISA KEV November 2026 explainer on four exploited flaws and the 12 November patch deadline — it shows how quickly a confirmed-exploitation listing follows a disclosure like this one.

Sources

Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697305), 12 November 2026
Citrix — NetScaler Console Security Bulletin (CTX697320), 12 November 2026
The Hacker News — Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass, 12 November 2026
SecurityOnline — Citrix NetScaler Vulnerabilities: 31 CVEs Fixed by Citrix, 12 November 2026
TechByCountry — Citrix XenServer Critical Vulnerability Explained: 8 Flaws, a Guest-to-Host Escape and the Patch to Apply
TechByCountry — CERT-In Chrome Warning November 2026 Explained: Zero-Day CVE-2026-125350 and How to Update Now