Citrix has issued updates to correct 28 vulnerabilities within its NetScaler ADC and NetScaler Gateway systems. Among these, CVE-2026-120868 stands out due to its impact on all default installations. Cloud Software Group disclosed this in bulletin CTX697305 on November 12, 2026, highlighting its critical nature.
Critical Vulnerabilities Affecting Default Installations
The flaw CVE-2026-120868, identified as a memory overflow issue, poses a significant risk, with a CVSS v4.0 score of 9.3. Unlike other vulnerabilities requiring specific configurations to be exploited, this one is active in all unpatched systems, making it especially dangerous. The exploit could lead to unpredictable device behavior or denial-of-service attacks. Notably, no user authentication is needed to launch this attack, increasing its potential threat.
Overview of Additional Security Concerns
Most of the vulnerabilities discovered are related to memory management issues, including buffer overflows and out-of-bounds writes. Citrix has noted that these could result in system crashes or erratic behavior if the relevant features are enabled. The most severe of these, CVE-2026-107412, has a CVSS score of 9.5 and affects systems configured as Gateways, such as SSL VPNs and ICA Proxy.
Several other vulnerabilities carry a score of 9.3, affecting services like SMPP traffic, DNS configurations, and authentication processes. Citrix advises immediate patching to mitigate these risks, especially given their potential impact.
Patching and Future Security Measures
Citrix has specified that the security bulletin applies to customer-managed devices running specific NetScaler versions. Secure Private Access setups using NetScaler also require updates, as there are no existing workarounds. Administrators are encouraged to review their configurations to identify which vulnerabilities could affect their systems.
Citrix acknowledged contributions from JPMorgan Chase’s XOR team, Capital One Offensive Security, and watchTowr in identifying these vulnerabilities. The company also noted its internal use of AI-assisted tools to uncover these issues, reflecting a growing trend in using AI for cybersecurity.
Conclusion and Recommendations
In light of these developments, administrators are strongly advised to upgrade their systems to the latest fixed builds. This includes ensuring that management interfaces are shielded from unsecured networks, particularly concerning CVE-2026-120863. Citrix has provided detailed guidance in its security bulletin, and users are urged to consult this resource and report any security issues to [email protected].
