critical government finance healthcare technology telecommunications

Citrix patches dozens of NetScaler ADC, Gateway, Console and Secure Access Client flaws, incl. CVE-2026-107412 (CVSS 9.5); no exploitation known

5 fonte(s) · 3 atualização(ões) · 2 repetição(ões) · publicado 12/11/2026 12:00 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 14/11/2026 00:01; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityweek.com ↗ cert.europa.eu ↗ thehackernews.com ↗ securityonline.info ↗

On 12 November 2026 Cloud Software Group (Citrix) released security updates for NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client for Windows and Linux. Securityonline.info counts four bulletins covering 31 CVEs, 28 of them memory-related flaws in ADC and Gateway. The most severe is CVE-2026-107412 (CVSS 9.5), which affects Gateway and AAA virtual server configurations. CVE-2026-120868 (CVSS 9.3) affects all deployments regardless of configuration and needs no authentication (securityonline.info). Both securityonline.info and thehackernews.com report no confirmed exploitation in the wild and no public proof-of-concept. CERT-FR (cert.cyber.gouv.fr) issued an advisory on 13 November 2026 urging prompt patching. Because NetScaler usually sits at the network edge handling VPN and similar functions, the exposure is significant (securityonline.info).

Entenda a falha

A vulnerabilidade

Citrix fixed 31 CVEs across NetScaler ADC, Gateway, Console and the Secure Access Client. The worst is CVE-2026-107412 (CVSS 9.5), several memory overflows in appliances set up as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, reachable without authentication per CERT-EU. CVE-2026-120868 (9.3) is a memory overflow in core packet processing that affects every deployment, default configuration included, and needs no login. CVE-2026-120869 (9.4) is an authentication bypass in NetScaler Console: an unauthenticated attacker with access to the Console IP reaches restricted resources, and the CVSS vector is adjacent-network. Seven more 9.3 overflows depend on a feature (SMPP, DNS/DoH, Push, Email OTP, EPA, ICA proxy). CVE-2026-118268 (Windows) and CVE-2026-118269 (Linux) (8.5) let a low-privileged local user reach SYSTEM or root. Affected: ADC/Gateway before 14.1-73.57 and 13.1-64.39, FIPS before 14.1-73.58, 13.1-FIPS/NDcPP before 13.1-37.293, Console 14.1 before 14.1-74.34, Windows client before 26.11.1.6, Linux client before 26.10.4. Those releases fix them.

Como funciona

For the ADC and Gateway flaws, network traffic reaches the appliance and is handled by the code that parses it: core packet processing, or a feature-specific parser such as SMPP, DNS-over-HTTPS, Email OTP or ICA proxy. When the input is processed, memory is written past its intended bounds or corrupted. The result, per the vendor, is unpredictable behavior or denial of service. The scores suggest a worse impact, but the bulletin does not claim code execution. For the Console, a request from an unauthenticated party reaches the management interface and gets access to restricted resources without the authentication check holding. The articles do not describe the internal steps of the client privilege escalations.

Por que é vulnerável

The ADC and Gateway bugs are memory-handling errors (overflows and corruption) in code that parses network traffic. The Console flaw is classified as improper authentication, and the client flaws as improper privilege management. The articles give no deeper root-cause detail or reason these went unnoticed. The fix is the patched releases, and Citrix says they came out of a deeper code review using AI-assisted analysis.

Como foi descoberta

Citrix says the updates follow a deeper review of its codebase that adds AI-assisted code analysis, aimed at hardening products before threats materialize. It is not aware of exploits for any of the flaws, and no source reports exploitation. Citrix published bulletins CTX697305 (ADC and Gateway) and CTX697320 (Console) on 12 November 2026, CERT-EU the same day and CERT-FR on 13 November. None of the new CVEs is in CISA's KEV catalog yet, per securityonline.info.

Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:17.

Detalhes técnicos

Most issues are memory overflow or corruption bugs that can cause unpredictable behavior, denial of service (DoS) or, in some cases, authentication bypass (securityonline.info, thehackernews.com).
CVE-2026-107412: CVSS 9.5, Gateway and AAA virtual server configurations.
CVE-2026-120868: CVSS 9.3, all NetScaler deployments, no authentication required.
CVE-2026-120869: authentication bypass in NetScaler Console.
CVE-2026-118268 and CVE-2026-118269: local privilege escalation in the Secure Access Client for Windows and Linux, fixed in recent client updates (thehackernews.com).
CERT-FR says the flaws affect the integrity and confidentiality of data, allow security policy bypass and enable remote DoS. It covers versions of the 13.1 and 14.1 branches prior to the patched releases, and cites bulletins CTX697305 and CTX697320. The CVE range it cites is CVE-2026-107407 to CVE-2026-120869 (cert.cyber.gouv.fr).
thehackernews.com gives per-CVE CVSS scores and affected configurations for 12 flaws, and lists fixed versions including the NetScaler ADC FIPS and NDcPP builds. It says the fixes come from a Citrix AI-assisted code review effort. Specific version numbers are not reproduced here.

Remediação

Apply the fixed NetScaler ADC, Gateway and Console releases, and the updated Secure Access Client builds for Windows and Linux, as listed in the Citrix bulletins (CTX697305, CTX697320). This includes the FIPS and NDcPP builds where used.
No workarounds exist, so patching is the only mitigation (securityonline.info).
Prioritize internet-facing Gateway and AAA virtual servers, and treat CVE-2026-120868 as affecting every deployment.

Relatos divergentes

Scope: securityonline.info reports 31 CVEs in four bulletins. thehackernews.com headlines 12 critical CVEs and describes this as an expansion of the 31 already reported. This appears to be a subset of the same release rather than a separate set. CERT-FR cites only two bulletins (CTX697305 and CTX697320) and a CVE range, so the full count is not confirmed by the vendor in these sources.
Exploitation: no source reports exploitation, and this is consistent across all three.

Linha do tempo

cert.cyber.gouv.fr ↗ · pub. 12/11/2026 21:00 · coletado 13/11 12:01

Multiple Critical Vulnerabilities Discovered in Citrix NetScaler and Console Products

ler a análise desta fonte ocultar

The French CERT-FR has published an advisory alerting multiple security vulnerabilities in Citrix NetScaler ADC, Gateway, and Console products. These vulnerabilities impact various versions prior to specific patched releases of the 13.1 and 14.1 branches, affecting the integrity and confidentiality of data, allowing security policy bypass, and enabling remote denial of service attacks. Citrix released security bulletins CTX697305 and CTX697320 on November 12, 2026, detailing these flaws and providing patches. The vulnerabilities cover a broad range of CVEs from CVE-2026-107407 through CVE-2026-120869, emphasizing the need for urgent patching to mitigate risk. Users of affected Citrix products should consult Citrix’s official advisories and update to the fixed versions promptly to restore security.
thehackernews.com ↗ · pub. 12/11/2026 12:38 · coletado 12/11 15:00

Citrix Releases Patches for 12 Critical NetScaler and Secure Access Client Vulnerabilities Including Authentication Bypass

This article adds detailed CVSS scores and specific impact descriptions for 12 individual CVEs affecting Citrix NetScaler and Secure Access Client products. It expands the list of patched vulnerabilities beyond the previously reported 31 CVEs, specifying affected configurations for each flaw and precise patched version numbers, including Citrix NetScaler ADC FIPS and NDcPP versions. The article confirms no active exploitation but emphasizes that the NetScaler Console authentication bypass (CVE-2026-120869) and privilege escalation CVEs (CVE-2026-118268, CVE-2026-118269) are fixed in recent Secure Access Client updates for Windows and Linux. It also highlights Citrix's use of AI-assisted code analysis in this security effort.

ler a análise desta fonte ocultar

This article adds detailed CVSS scores and specific impact descriptions for 12 individual CVEs affecting Citrix NetScaler and Secure Access Client products. It expands the list of patched vulnerabilities beyond the previously reported 31 CVEs, specifying affected configurations for each flaw and precise patched version numbers, including Citrix NetScaler ADC FIPS and NDcPP versions. The article confirms no active exploitation but emphasizes that the NetScaler Console authentication bypass (CVE-2026-120869) and privilege escalation CVEs (CVE-2026-118268, CVE-2026-118269) are fixed in recent Secure Access Client updates for Windows and Linux. It also highlights Citrix's use of AI-assisted code analysis in this security effort.

Citrix has addressed multiple critical vulnerabilities in its NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client affecting Windows and Linux. The flaws primarily involve memory overflow and corruption issues that may lead to denial-of-service (DoS) conditions or authentication bypass. Notable CVEs include CVE-2026-120868 impacting all NetScaler deployments and CVE-2026-107412 with a CVSS score of 9.5 affecting Gateway and AAA virtual servers. Additional fixes cover privilege escalation vulnerabilities in Secure Access Client for Windows and Linux. None of the vulnerabilities are currently known to be exploited in the wild, but Citrix urges immediate patching to enhance NetScaler's security posture. The updates are part of an AI-assisted code review initiative by Citrix to proactively harden its products.
securityonline.info ↗ · pub. 12/11/2026 12:00 · coletado 12/11 13:00 primeiro registro

Critical Citrix NetScaler Vulnerabilities Fixed, Including Default-Config Exposure with CVSS 9.5

ler a análise desta fonte ocultar

Cloud Software Group released four security bulletins addressing 31 CVEs affecting Citrix NetScaler products, primarily NetScaler ADC and Gateway, which received fixes for 28 memory-related vulnerabilities. The highest severity is CVE-2026-107412 with a CVSS 9.5 score, impacting Gateway and AAA virtual server configurations. Notably, CVE-2026-120868 affects all deployments regardless of configuration, requiring no authentication and scoring 9.3, making it particularly critical. The issues mainly involve memory overflows and can cause unpredictable behavior or denial of service, with no confirmed exploitation or public proof-of-concept exploits observed. Additional vulnerabilities include an authentication bypass in NetScaler Console (CVE-2026-120869) and local privilege escalations in Secure Access Clients for Windows and Linux. Given NetScaler's typical placement on network edges handling VPN and related functions, these flaws pose significant risk. Immediate patching is strongly recommended as no workarounds exist.