Skip to content
Centoculus
en

Security alert · Critical

Citrix NetScaler ADC and Gateway: critical memory flaws allow denial of service (CVE-2026-120868)

· 4 minutes read · Centoculus Security Team

Known since

Affected: NetScaler ADC and NetScaler Gateway before 14.1-73.57 and 13.1-64.39; NetScaler ADC 14.1-FIPS before 14.1-73.58; 13.1-FIPS/13.1-NDcPP before 13.1-37.293

What happened

On 13 November 2026 Citrix published security updates for NetScaler ADC and NetScaler Gateway (advisory CTX697305). The most broadly relevant flaw is CVE-2026-120868 (CVSS 9.3). It is a memory overflow in packet processing that can lead to unpredictable or erroneous behaviour or a denial of service (DoS). According to the advisory, it affects all NetScaler ADC and NetScaler Gateway deployments, whatever their configuration.

The same release fixes eight more critical memory flaws. Each of these only matters if a certain feature is configured:

  • CVE-2026-107407 (CVSS 9.3): memory overflow in SMPP traffic. Affects Load Balancing or Content Switching virtual servers of type SMPP.
  • CVE-2026-107408 (CVSS 9.3): memory corruption in DNS / DNS-over-HTTPS. Affects appliances configured for DNS load balancing and recursive DNS resolution.
  • CVE-2026-107409 (CVSS 9.3): memory corruption in DNS-over-HTTPS. Affects DNS load balancing over HTTPS.
  • CVE-2026-107410 (CVSS 9.3): memory overflow in NetScaler Push. Affects Load Balancing virtual servers of type PUSH.
  • CVE-2026-107412 (CVSS 9.5): multiple memory overflows. Affects appliances configured as a Gateway or AAA virtual server.
  • CVE-2026-107415 (CVSS 9.3): memory overflow in Email OTP authentication. Affects configurations with an Email Action.
  • CVE-2026-111344 (CVSS 9.3): memory overflow in Endpoint Analysis (EPA/EPAS). Affects VPN or AAA virtual servers that use Endpoint Analysis.
  • CVE-2026-120864 (CVSS 9.3): memory overflow in the ICA proxy. Affects Gateway VPN, AAA or CR (type HDX) virtual servers.

All of these can lead to unpredictable behaviour or a denial of service. At the time of publication, Citrix said it was not aware of any exploits for these vulnerabilities. CISA does not list them as exploited.

On the same day Citrix also fixed three flaws in other products, each in its own advisory:

  • CVE-2026-120869 (CVSS 9.4): an authentication bypass in NetScaler Console. Fixed in 14.1-74.34 and later.
  • CVE-2026-118268: privilege escalation to SYSTEM in Secure Access Client for Windows. Fixed in 26.11.1.6 and later.
  • CVE-2026-118269: privilege escalation to root in Secure Access Client for Linux. Fixed in 26.10.4 and later.

Who is affected

You are affected by CVE-2026-120868 if you run NetScaler ADC or NetScaler Gateway older than these fixed releases:

  • NetScaler ADC and NetScaler Gateway 14.1: fixed in 14.1-73.57 and later
  • NetScaler ADC and NetScaler Gateway 13.1: fixed in 13.1-64.39 and later releases of 13.1
  • NetScaler ADC 14.1-FIPS: fixed in 14.1-73.58 FIPS and later releases of 14.1-FIPS
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP: fixed in 13.1-37.293 and later releases of 13.1-FIPS and 13.1-NDcPP

The other eight NetScaler ADC and Gateway flaws only apply if the feature named next to them is configured. CVE-2026-120868 does not depend on configuration, so every appliance below the fixed versions needs the update.

Systems that do not run NetScaler are not affected: ordinary web servers, mail servers or hosting panels. If you only use NetScaler Console or the Secure Access Client, see the separate Citrix advisories for those products.

What to do now

  1. List all NetScaler ADC and NetScaler Gateway instances, including HA pairs, VPX instances in the cloud and appliances you run for customers.
  2. Back up the configuration of each instance (ns.conf) before you upgrade.
  3. Upgrade to 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 (FIPS/NDcPP), or a later release of your branch. In HA pairs, upgrade the secondary node first, fail over, then upgrade the former primary.
  4. After the reboot, check that the virtual servers are up and that Gateway, VPN and authentication logins work.
  5. If you use NetScaler Console, update it to 14.1-74.34 or later. Update Secure Access Client installations on Windows (26.11.1.6) and Linux (26.10.4).
  6. If you cannot upgrade right away, limit access to management interfaces to trusted networks and watch the appliances for unexpected restarts or crashes until the update is installed.

How to check whether you are affected

Check the installed build in the management GUI or with the CLI command show ns version. If the build is lower than the fixed version for your branch, the appliance is vulnerable to CVE-2026-120868. To see whether the other flaws also apply, compare your configuration with the conditions above, for example SMPP or PUSH virtual servers, DNS load balancing, Gateway/AAA virtual servers, Email OTP, Endpoint Analysis or ICA proxy. Citrix's advisory CTX697305 has the full details.

Sources

More sources (2)

If you run firewalls or VPN gateways, also check

Related posts