Citrix has patched a critical memory overflow flaw in NetScaler ADC and NetScaler Gateway that affects every deployment of the products, including appliances running the default configuration. Tracked as CVE-2026-120868, the vulnerability carries a CVSS score of 9.3 and sits in the packet processing code at the heart of the gateway.

The flaw was disclosed on 12 November 2026 as part of a wider round of Citrix security bulletins covering NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client. Because NetScaler appliances usually sit at the network edge, handling VPN access, load balancing and single sign-on, they are directly reachable from the internet in many deployments, which makes unpatched flaws in them a priority for administrators.

What is CVE-2026-120868?

CVE-2026-120868 is a memory overflow vulnerability in packet processing. According to Citrix, it can lead to unpredictable or erroneous behaviour or a denial of service. It needs no special feature to be enabled and no login, which is what sets it apart from several of the other flaws fixed in the same release. The Citrix bulletin states plainly that all NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration, so administrators cannot rule out exposure by checking which features they have switched on.

The flaw is one of 28 memory flaws fixed in NetScaler ADC and Gateway in this release, most of them in the code that parses network traffic. Citrix uses the same wording for nearly all of them: each can lead to unpredictable behaviour or denial of service. The bulletin does not claim code execution.

The other flaws fixed in the same release

The highest-scored flaw in the batch is CVE-2026-107412, rated 9.5, which covers multiple memory overflows affecting appliances configured as a Gateway or an AAA virtual server. The remaining ADC and Gateway flaws, each rated 9.3, affect specific features: CVE-2026-107407 in SMPP traffic, CVE-2026-107408 in DNS and DNS-over-HTTPS, CVE-2026-107409 in DNS-over-HTTPS, CVE-2026-107410 in NetScaler Push, CVE-2026-107415 in Email OTP authentication, CVE-2026-111344 in Endpoint Analysis, and CVE-2026-120864 in the ICA proxy.

Separate bulletins cover NetScaler Console and the Secure Access Client for Windows and Linux, including an improper authentication flaw in the Console and privilege escalation flaws in the clients. Administrators should check all four bulletins, not only the ADC and Gateway one, when planning the update.

Which versions are affected and how to fix them

NetScaler ADC and Gateway versions 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39 are affected. Fixed builds are 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS for FIPS appliances, and 13.1-37.293 for FIPS and NDcPP appliances. Cloud Software Group strongly urges affected customers to install the fixed builds as soon as possible. The bulletins list no workaround, so upgrading is the only fix.

Administrators should patch internet-facing Gateway and AAA appliances first, since CVE-2026-120868 and CVE-2026-107412 can be reached without a login. Restricting access to the NetScaler Console so that only trusted management hosts can reach it is also advised while upgrades are scheduled. Citrix-managed cloud services and Adaptive Authentication receive updates from Cloud Software Group directly.

No known exploitation, but a familiar target

Citrix said it is not aware of any exploits for any of the announced vulnerabilities, and no public proof of concept has been confirmed. The company said the security updates follow a deeper review of its codebase using AI-assisted code analysis to detect and resolve vulnerabilities before threats could materialise.

Even so, NetScaler flaws have a record of being exploited once they are public. CISA added six NetScaler CVEs from 2026 to its Known Exploited Vulnerabilities catalogue between March and October, although none of the newly disclosed flaws appear in the catalogue yet. That history is why security teams treat NetScaler patches as urgent, and why this batch should not wait for the next routine maintenance window.

Sources: The Hacker News and SecurityOnline