Multiple Critical Vulnerabilities Discovered in Citrix NetScaler and Console Products
The French CERT-FR has published an advisory alerting multiple security vulnerabilities in Citrix NetScaler ADC, Gateway, and Console products. These vulnerabilities impact various versions prior to specific patched releases of the 13.1 and 14.1 branches, affecting the integrity and confidentiality of data, allowing security policy bypass, and enabling remote denial of service attacks. Citrix released security bulletins CTX697305 and CTX697320 on November 12, 2026, detailing these flaws and providing patches. The vulnerabilities cover a broad range of CVEs from CVE-2026-107407 through CVE-2026-120869, emphasizing the need for urgent patching to mitigate risk. Users of affected Citrix products should consult Citrix’s official advisories and update to the fixed versions promptly to restore security.
Entenda a falha
A vulnerabilidade
Citrix published fixes for a large batch of vulnerabilities (CVE-2026-107407 to CVE-2026-107415, CVE-2026-111333 to CVE-2026-111342 and CVE-2026-120860 to CVE-2026-120869) in NetScaler ADC, NetScaler Gateway and NetScaler Console. According to CERT-FR, the impacts include loss of data integrity and confidentiality, security policy bypass and remote denial of service. The sources give no per-CVE breakdown, severity or attacker prerequisites. Affected: ADC and Gateway before 13.1-64.39 and before 14.1-73.57; ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.293; ADC 14.1-FIPS before 14.1-73.58 FIPS; Console before 14.1-74.34. Those are also the fixed releases.
Como foi descoberta
The articles do not say who found the flaws or how. Citrix released security bulletins CTX697305 (ADC and Gateway) and CTX697320 (Console, titled for CVE-2026-120869) on 12 November 2026, and CERT-FR published its advisory CERTFR-2026-AVI-1528 on 13 November 2026. Neither source mentions exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:21.
Linha do tempo
-
Multiple Critical Vulnerabilities Discovered in Citrix NetScaler and Console Products
ler a análise desta fonte ocultar
The French CERT-FR has published an advisory alerting multiple security vulnerabilities in Citrix NetScaler ADC, Gateway, and Console products. These vulnerabilities impact various versions prior to specific patched releases of the 13.1 and 14.1 branches, affecting the integrity and confidentiality of data, allowing security policy bypass, and enabling remote denial of service attacks. Citrix released security bulletins CTX697305 and CTX697320 on November 12, 2026, detailing these flaws and providing patches. The vulnerabilities cover a broad range of CVEs from CVE-2026-107407 through CVE-2026-120869, emphasizing the need for urgent patching to mitigate risk. Users of affected Citrix products should consult Citrix’s official advisories and update to the fixed versions promptly to restore security.