Citrix NetScaler ADC and Gateway flaws can take instances offline

Citrix has released security patches for 28 vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway. Nine of the flaws are rated critical, and some can be used to cause denial of service or crash affected instances. Hybrid Secure Private Access environments with NetScaler instances are also affected.

Critical flaws and configuration requirements

CVE-2026-120868 affects both products in their default configuration and is located in packet processing; a memory error can lead to unpredictable behavior or denial of service. Other critical denial of service issues require specific settings, such as DNS load balancing over DNS-over-HTTPS for CVE-2026-107409 or DNS load balancing with recursive DNS resolution for CVE-2026-107408. CVE-2026-107412, rated critical with a CVSS score of 9.5, requires NetScaler to be configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.

Other severity levels and local access issue

Most of the remaining vulnerabilities are rated high severity, including denial of service cases such as CVE-2026-120861. Four vulnerabilities are rated medium. One medium issue, CVE-2026-111348, could cause authentication data to be written to a log file, but attackers need local access to read it.

Patched versions and update schedule

Admins must install one of the listed versions or a later one to protect instances: Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.57; Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.39; Citrix NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS; and Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293. Citrix also updates cloud services that it manages itself. Citrix says it will now release security patches monthly on a fixed schedule, as close as possible to Patch Tuesday, with out-of-schedule updates possible in urgent cases such as active exploitation. The latest patches are the first under this program.

Discovery and exploitation status

Citrix has not yet reported cases of attackers exploiting the vulnerabilities. The company says it discovered some of the vulnerabilities using AI-assisted code analysis. A critical Citrix NetScaler vulnerability also made headlines in early October.

Earlier coverage: Citrix fixed an exploited NetScaler zero-day affecting SAML deployments

Sources: heise online · CERT-EU · Citrix