Citrix Patches 10 Critical NetScaler Vulnerabilities
Citrix patches 28 NetScaler vulnerabilities, including 9 critical flaws.
Citrix has released patches for 28 vulnerabilities affecting NetScaler ADC and NetScaler Gateway, with nine of these rated as critical. The critical flaws are due to memory overflow issues in various components and could lead to denial-of-service conditions. Additionally, a critical vulnerability in NetScaler Console, tracked as CVE-2026-120869 with a CVSS score of 9.4, allows unauthenticated attackers to bypass controls and access restricted resources. While no exploitation in the wild has been reported, Citrix urges customers to update their instances promptly.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCitrix disclosed 28 vulnerabilities in NetScaler ADC, NetScaler Gateway, and NetScaler Console, including ten critical flaws stemming from memory overflow issues and an authentication bypass (CVE-2026-120869, CVSS 9.4) that allows unauthenticated attackers to access restricted resources. NetScaler products are widely deployed as internet-facing network gateways, making them high-value targets where unpatched flaws can expose entire internal networks. The authentication bypass is particularly dangerous because it requires no credentials, lowering the bar for attackers significantly. Although no active exploitation has been confirmed yet, historically Citrix vulnerabilities are weaponized rapidly once patches are published and reverse-engineered. Organizations must treat this as a time-critical patching event rather than a routine maintenance cycle.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-120868
- cve — CVE-2026-107407
- cve — CVE-2026-107408
- cve — CVE-2026-107409
- cve — CVE-2026-107410
- cve — CVE-2026-107412
- cve — CVE-2026-107415
- cve — CVE-2026-111334
- cve — CVE-2026-120864
- cve — CVE-2026-111338
- cve — CVE-2026-120869