Critical Citrix NetScaler Vulnerabilities Fixed, Including Default-Config Exposure with CVSS 9.5
Cloud Software Group released four security bulletins addressing 31 CVEs affecting Citrix NetScaler products, primarily NetScaler ADC and Gateway, which received fixes for 28 memory-related vulnerabilities. The highest severity is CVE-2026-107412 with a CVSS 9.5 score, impacting Gateway and AAA virtual server configurations. Notably, CVE-2026-120868 affects all deployments regardless of configuration, requiring no authentication and scoring 9.3, making it particularly critical. The issues mainly involve memory overflows and can cause unpredictable behavior or denial of service, with no confirmed exploitation or public proof-of-concept exploits observed. Additional vulnerabilities include an authentication bypass in NetScaler Console (CVE-2026-120869) and local privilege escalations in Secure Access Clients for Windows and Linux. Given NetScaler's typical placement on network edges handling VPN and related functions, these flaws pose significant risk. Immediate patching is strongly recommended as no workarounds exist.
This article adds detailed CVSS scores and specific impact descriptions for 12 individual CVEs affecting Citrix NetScaler and Secure Access Client products. It expands the list of patched vulnerabilities beyond the previously reported 31 CVEs, specifying affected configurations for each flaw and precise patched version numbers, including Citrix NetScaler ADC FIPS and NDcPP versions. The article confirms no active exploitation but emphasizes that the NetScaler Console authentication bypass (CVE-2026-120869) and privilege escalation CVEs (CVE-2026-118268, CVE-2026-118269) are fixed in recent Secure Access Client updates for Windows and Linux. It also highlights Citrix's use of AI-assisted code analysis in this security effort.
Entenda a falha
A vulnerabilidade
Cloud Software Group fixed 31 CVEs in four bulletins; the story's CVEs are covered here. CVE-2026-107412 (CVSS 4.0 9.5) is a set of memory overflows in NetScaler ADC/Gateway appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. CVE-2026-120868 (9.3) is in core packet processing, affects every deployment including the default configuration, and needs no login. CVE-2026-120869 (9.4) is an unauthenticated authentication bypass in NetScaler Console, reachable from the adjacent network via the Console IP. CVE-2026-118268 (Windows) and CVE-2026-118269 (Linux), both 8.5, let a low-privileged local user reach SYSTEM or root in Secure Access Client. CVE-2026-111348 writes sensitive authentication material to a log readable locally. Fixed in ADC/Gateway 14.1-73.57 and 13.1-64.39 (FIPS 14.1-73.58; FIPS/NDcPP 13.1-37.293), Console 14.1-74.34, Client for Windows 26.11.1.6 and for Linux 26.10.4. There is no workaround.
Como funciona
On ADC and Gateway, network traffic reaches the appliance, which sits at the network edge handling VPN, load balancing and single sign-on, and its parsing code processes the packets or protocol messages. Most of the flaws are memory overflows in that parsing code, some in core packet processing and others in features such as SAML, LDAP, HTTP/2, HTTP/3, DNS-over-HTTPS or BGP. When a malformed input hits the overflow, memory is corrupted, which Citrix describes as unpredictable or erroneous behavior or denial of service. On the Console, a request to its IP address skips the authentication controls and reaches restricted resources. In the clients, a local standard account abuses weak privilege handling to gain higher rights.
Por que é vulnerável
For the ADC and Gateway bugs the root cause is memory overflows in code that parses network traffic, meaning input is not properly bounded before it is written to memory. The Console flaw is a failure of authentication controls, and the two client flaws are improper privilege management. CVE-2026-111348 is sensitive authentication material being written to a log file. The articles do not explain why these went unnoticed or what exactly each patch changes, other than that upgrading is the only fix.
Como foi descoberta
The articles do not say who found these flaws or how. They became public through four security bulletins from Cloud Software Group, which strongly urges customers to install the fixed builds. Citrix reports no exploitation, and none of the new CVEs are yet in CISA's KEV catalog, though six 2026 NetScaler CVEs were added between March and October.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:15.
Linha do tempo
-
Citrix Releases Patches for 12 Critical NetScaler and Secure Access Client Vulnerabilities Including Authentication Bypass
This article adds detailed CVSS scores and specific impact descriptions for 12 individual CVEs affecting Citrix NetScaler and Secure Access Client products. It expands the list of patched vulnerabilities beyond the previously reported 31 CVEs, specifying affected configurations for each flaw and precise patched version numbers, including Citrix NetScaler ADC FIPS and NDcPP versions. The article confirms no active exploitation but emphasizes that the NetScaler Console authentication bypass (CVE-2026-120869) and privilege escalation CVEs (CVE-2026-118268, CVE-2026-118269) are fixed in recent Secure Access Client updates for Windows and Linux. It also highlights Citrix's use of AI-assisted code analysis in this security effort.
ler a análise desta fonte ocultar
This article adds detailed CVSS scores and specific impact descriptions for 12 individual CVEs affecting Citrix NetScaler and Secure Access Client products. It expands the list of patched vulnerabilities beyond the previously reported 31 CVEs, specifying affected configurations for each flaw and precise patched version numbers, including Citrix NetScaler ADC FIPS and NDcPP versions. The article confirms no active exploitation but emphasizes that the NetScaler Console authentication bypass (CVE-2026-120869) and privilege escalation CVEs (CVE-2026-118268, CVE-2026-118269) are fixed in recent Secure Access Client updates for Windows and Linux. It also highlights Citrix's use of AI-assisted code analysis in this security effort.
Citrix has addressed multiple critical vulnerabilities in its NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client affecting Windows and Linux. The flaws primarily involve memory overflow and corruption issues that may lead to denial-of-service (DoS) conditions or authentication bypass. Notable CVEs include CVE-2026-120868 impacting all NetScaler deployments and CVE-2026-107412 with a CVSS score of 9.5 affecting Gateway and AAA virtual servers. Additional fixes cover privilege escalation vulnerabilities in Secure Access Client for Windows and Linux. None of the vulnerabilities are currently known to be exploited in the wild, but Citrix urges immediate patching to enhance NetScaler's security posture. The updates are part of an AI-assisted code review initiative by Citrix to proactively harden its products.
-
Critical Citrix NetScaler Vulnerabilities Fixed, Including Default-Config Exposure with CVSS 9.5
ler a análise desta fonte ocultar
Cloud Software Group released four security bulletins addressing 31 CVEs affecting Citrix NetScaler products, primarily NetScaler ADC and Gateway, which received fixes for 28 memory-related vulnerabilities. The highest severity is CVE-2026-107412 with a CVSS 9.5 score, impacting Gateway and AAA virtual server configurations. Notably, CVE-2026-120868 affects all deployments regardless of configuration, requiring no authentication and scoring 9.3, making it particularly critical. The issues mainly involve memory overflows and can cause unpredictable behavior or denial of service, with no confirmed exploitation or public proof-of-concept exploits observed. Additional vulnerabilities include an authentication bypass in NetScaler Console (CVE-2026-120869) and local privilege escalations in Secure Access Clients for Windows and Linux. Given NetScaler's typical placement on network edges handling VPN and related functions, these flaws pose significant risk. Immediate patching is strongly recommended as no workarounds exist.