Citrix NetScaler Vulnerabilities Fixed Across 28 Flaws in ADC and Gateway

Citrix released security updates on November 12, 2026, that address 28 vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway appliances. The updates appear in bulletin CTX697305 and carry a Critical rating. The fixes target memory-handling issues that affect load balancing, SSL VPN, and application delivery functions.

Citrix NetScaler Vulnerabilities Addressed in Bulletin CTX697305

The bulletin covers multiple memory overflow conditions in packet processing paths. CVE-2026-120868 carries a CVSS v4.0 score of 9.3 and impacts every deployment, including default configurations, without requiring specific features or authentication. Exploitation can produce unpredictable behavior or denial-of-service conditions. No workaround exists for this flaw.

Additional issues include CVE-2026-107412, rated 9.5, which affects Gateway and AAA configurations, along with separate memory overflows in SMPP, DNS, DoH, NetScaler Push, Email OTP, EPA, and ICA proxy modules. Roughly nine to ten of the 28 flaws received critical severity ratings. A related bulletin, CTX697320, fixes CVE-2026-120869, an unauthenticated authentication bypass in NetScaler Console version 14.1 before 14.1-74.34.

Affected customer-managed versions include NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58 FIPS, and 13.1-FIPS/NDcPP before 13.1-37.293. Secure Private Access hybrid setups that rely on NetScaler instances are also exposed. Fixed builds are 14.1-73.57 and later, 13.1-64.39 and later, plus the corresponding FIPS and NDcPP releases. Administrators must upgrade both nodes in high-availability pairs.

Context and Next Steps for NetScaler Deployments

NetScaler appliances, previously known as Citrix ADC and Gateway, provide load balancing and secure remote access for enterprise applications. Earlier 2026 bulletins addressed remote code execution issues in September and October. The November batch centers on memory-safety problems rather than authentication or injection vectors.

Citrix states that no exploitation of the November 12 vulnerabilities has been observed. Cloud-managed NetScaler services receive updates directly from the vendor. Separate patches were issued for the Secure Access Client on Windows and Linux platforms.

Administrators should inventory all appliances, prioritize internet-facing Gateway and AAA instances, and apply the updated builds without delay. Monitoring for post-upgrade stability and any subsequent exploitation reports remains necessary because several flaws allow denial-of-service outcomes with minimal attacker effort.