Citrix has patched a critical authentication bypass in NetScaler Console that allowed an unauthenticated attacker to bypass authentication controls and reach restricted resources on the appliance. The flaw, tracked as CVE-2026-120869 and scored 9.4 under CVSS, affects all NetScaler Console 14.1 releases before 14.1-74.34 and is fixed in that build, SecurityWeek reported on 13 November 2026.

NetScaler Console is the central management plane for Citrix NetScaler deployments, used to manage and monitor the application delivery controllers and gateways that sit at the network edge. An attacker who can reach the Console's IP address needs no username or password to exploit the flaw, according to the vendor bulletin quoted in the reporting. The CVSS vector marks the attack as adjacent-network rather than internet-wide, so exposure depends on how the management interface is networked.

One flaw in a 31-CVE patch batch

The Console fix arrived on 12 November as part of a wider Citrix release covering four security bulletins and 31 vulnerabilities. The bulk of the batch sits in NetScaler ADC and NetScaler Gateway, which received fixes for 28 memory flaws, nine of them critical. The most severe of those, CVE-2026-107412, scores 9.5, while CVE-2026-120868, a memory flaw in core packet processing, scores 9.3 and affects every ADC and Gateway deployment, including those running the default configuration.

The same release also fixed two local privilege-escalation flaws in the Secure Access Client: CVE-2026-118268 on Windows, which lets a low-privileged user escalate to SYSTEM, and CVE-2026-118269 on Linux, which lets the same kind of user gain root access. Both score 8.5 and need a standard account on the machine.

No exploitation reported, but no workaround

Citrix says it is not aware of any exploits for the announced vulnerabilities, and no public proof-of-concept exploit has been confirmed, according to SecurityOnline.info. That is reassuring but not a reason to delay: vulnerabilities in NetScaler are a frequent target for attackers, and six NetScaler flaws from 2026 were added to the US CISA Known Exploited Vulnerabilities catalogue between March and October this year.

The bulletins list no workaround for the Console flaw, so upgrading is the only fix. Cloud Software Group strongly urges affected customers to install the fixed builds as soon as possible. Administrators should patch internet-facing Gateway and AAA appliances first, then restrict NetScaler Console so that only trusted management hosts can reach it, and watch for CISA catalogue additions given the product's history as an exploitation target.

Source: SecurityWeek