> ## Content Index
> Fetch the complete content index at: https://cms.thedarkwebnews.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Citrix Patches 10 Critical NetScaler Vulnerabilities
- URL: https://cms.thedarkwebnews.com/citrix-patches-10-critical-netscaler-vulnerabilities/
- Published: 2026-11-13T09:59:33.000Z
- Updated: 2026-11-13T09:59:33.000Z
- Author: Darkintel Team
- Tags: Vulnerability, Patch

Citrix has released security updates fixing 10 critical vulnerabilities across its NetScaler products. Nine of them affect NetScaler ADC and NetScaler Gateway. The tenth is a separate flaw in NetScaler Console that could let unauthenticated attackers bypass access controls. Citrix also fixed many high- and medium-severity bugs, and urges customers to update as soon as possible.

**Nine critical memory overflow flaws in NetScaler ADC and Gateway**  
The critical vulnerabilities come from memory overflow issues in several NetScaler components and could lead to unpredictable or erroneous behavior, or denial-of-service (DoS) conditions. The affected components are:

- Packet Processing
- SMPP traffic handling
- DNS and DNS-over-HTTPS (DoH)
- NetScaler Push
- Email OTP authentication
- Endpoint Analysis (EPA/EPAS)
- ICA proxy

The critical flaws are tracked as:

- CVE-2026-120868
- CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410
- CVE-2026-107412
- CVE-2026-107415
- CVE-2026-111334
- CVE-2026-120864

**High- and medium-severity flaws**  
Most of the remaining 19 NetScaler ADC and Gateway vulnerabilities are high-severity weaknesses with similar outcomes. Citrix also fixed several medium-severity bugs, including **CVE-2026-111338**, which exposes sensitive authentication material in a log file. Some vulnerabilities only apply under specific configurations, and Citrix’s advisory lists the preconditions for each one.

**The tenth critical flaw: NetScaler Console (CVE-2026-120869)**  
On Thursday, Citrix also announced patches for a critical flaw in NetScaler Console, tracked as CVE-2026-120869 (CVSS 9.4). It could let unauthenticated attackers bypass controls and reach restricted resources. All NetScaler Console 14.1 releases before **14.1-74.34** are affected.

**Fixed versions**

| Product                                | Fixed version         |
| -------------------------------------- | --------------------- |
| NetScaler ADC and Gateway 14.1         | 14.1-73.57 and later  |
| NetScaler ADC and Gateway 13.1         | 13.1-64.39 and later  |
| NetScaler ADC 14.1-FIPS                | 14.1-73.58 and later  |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | 13.1-37.293 and later |
| NetScaler Console 14.1                 | 14.1-74.34 and later  |

**Exploitation status**  
Citrix does not mention any of these vulnerabilities being exploited in the wild. However, NetScaler appliances are a frequent and high-value target for threat actors. They often sit at the network edge, handle authentication and remote access, and past NetScaler flaws have been widely exploited soon after disclosure. Patch quickly.

**Why it matters**  
NetScaler ADC and Gateway often provide remote access to corporate environments, including VPN, ICA proxy for Citrix Virtual Apps and Desktops, and authentication services. A DoS condition on these appliances could cut off remote access for an entire organization. The log-file exposure (CVE-2026-111338) and the Console bypass (CVE-2026-120869) could give attackers a foothold for broader compromise.

**Recommendations**

- **Update NetScaler ADC and Gateway** to the fixed versions listed above as soon as possible.
- **Update NetScaler Console** to 14.1-74.34 or later, and restrict Console access to trusted management networks.
- **Check Citrix’s advisory for the preconditions** of each vulnerability, to understand your exposure based on which features are enabled (DNS, DoH, Email OTP, EPA, ICA proxy, NetScaler Push, SMPP).
- **Review and protect logs:** Given CVE-2026-111338, check who can read NetScaler log files. If sensitive authentication material may have been exposed, consider rotating the affected credentials.
- **Watch appliances** for unexpected crashes, reboots, or unusual traffic patterns, which could point to exploitation attempts.
- **Inventory internet-facing NetScaler instances**, including end-of-life versions that may not get patches.

We will update this post if active exploitation is reported.