Citrix has rolled out updates to address a series of vulnerabilities in its NetScaler ADC and NetScaler Gateway products, including several classified as critical. The announcement, made on Thursday, highlights the importance of immediate action to secure affected systems.
Critical Vulnerabilities in NetScaler
The critical issues identified involve memory overflow challenges affecting Packet Processing, SMPP traffic, DNS/DNS-over-HTTPS (DoH), NetScaler Push, Email OTP authentication, Endpoint Analysis (EPA/EPAS), and the ICA proxy. These vulnerabilities can lead to severe consequences such as denial-of-service (DoS) conditions or erratic system behavior.
These critical vulnerabilities are documented as CVE-2026-120868 and from CVE-2026-107407 to CVE-2026-107410, along with others like CVE-2026-107412, CVE-2026-107415, CVE-2026-111334, and CVE-2026-120864. Additionally, several high-severity flaws were also patched, sharing potential outcomes with the critical ones.
Details of Patched Versions
Citrix has provided patches for these vulnerabilities in NetScaler ADC and Gateway versions 14.1-73.57 and above, 13.1-64.39 and above, 14.1-73.58 FIPS and later, including 13.1-FIPS and 13.1-NDcPP 13.1-37.293. Customers are strongly encouraged to update their instances to these versions to mitigate risks.
Moreover, an additional critical vulnerability tracked as CVE-2026-120869, possessing a CVSS score of 9.4, has been identified in NetScaler Console. This flaw could allow unauthorized attackers to bypass security measures and gain access to restricted resources. This issue affects all NetScaler Console 14.1 versions prior to 14.1-74.34.
Call to Action for Users
Citrix has not reported any active exploitation of these vulnerabilities but stresses the importance of promptly updating to protect against potential threats. With NetScaler often targeted in cyberattacks, implementing these patches is a critical step in maintaining robust security.
For more details on the specific vulnerabilities and instructions for patching, users are advised to consult Citrix’s official documentation. Staying informed and proactive about security updates can significantly reduce the risk of exploitation and secure sensitive data effectively.
