Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations

Citrix disclosed 28 vulnerabilities in NetScaler ADC and Gateway, including a critical memory overflow (CVE-2026-120868, CVSS 9.3) that affects every default deployment without requiring authentication or user interaction. Because the flaw exists in the default configuration, every unpatched NetScaler instance is exposed the moment it is reachable by an attacker — no misconfiguration or privilege escalation is needed. Memory-safety bugs like buffer overflows and double frees are well-understood vulnerability classes, yet they continue to appear in widely deployed network appliances, making timely patching essential. Organizations that lack a structured process for prioritizing and applying vendor patches to internet-facing appliances are at the highest risk, as these devices sit at the network perimeter and are often the first target in an intrusion.