Overview
- Citrix published a large NetScaler security bulletin on Thursday and released fixed builds (for example 14.1-73.57 and 13.1-64.39 plus corresponding FIPS/NDcPP releases) that address multiple high-severity vulnerabilities across NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client.
- CVE-2026-120868 is a memory overflow in packet processing with a CVSS v4.0 base score of 9.3 that is reachable from the network without credentials or user interaction and applies to all NetScaler ADC and Gateway deployments.
- Other critical flaws include an improper-authentication bug in NetScaler Console (CVE-2026-120869, CVSS 9.4) that can allow unauthenticated access and several role-specific memory-overflow defects that can cause unpredictable behavior or denial-of-service.
- Security guidance from Citrix and analysts says administrators must install the exact fixed builds, record each appliance’s role and running build, verify post-patch behavior and preserve crash dumps or volatile evidence, and use network controls to reduce exposure if immediate patching is not possible.
- Because NetScaler appliances parse traffic at the network edge before authentication, these parser bugs raise outsized risk for internet-facing virtual IPs; Citrix said it used AI-assisted code analysis in its review and currently reports no known in-the-wild exploits.