Citrix released four security bulletins on November 12 that fix 31 CVEs across NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client, including an unauthenticated access-control bypass in NetScaler Console rated CVSS 9.4. The company says it knows of no exploitation.
28 Memory Flaws in NetScaler ADC and Gateway
The bulk of the release covers NetScaler ADC and Gateway, where Citrix fixed 28 memory-handling flaws. One outlet counted nine of them as critical. Most are overflows in packet processing, SMPP, DNS and DoH, NetScaler Push, Email OTP, EPA and the ICA proxy, and they can cause unpredictable behavior or denial of service.
Counts differ across coverage: some outlets report ten critical issues, others nine, and some tally 12 flaws instead of 28, depending on how the bulletins are grouped.
CVE-2026-120868 and CVE-2026-107412: The Highest-Scoring ADC Bugs
CVE-2026-120868 scores 9.3 under CVSS 4.0 and affects all deployments, including the default configuration, which means administrators cannot rule themselves out by checking for an optional feature. CVE-2026-107412 scores highest in the batch at 9.5. A third issue, CVE-2026-111338, exposes authentication material in a log file.
Fixed ADC and Gateway Builds
Citrix lists the fixed builds as 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP, and later releases of each.
NetScaler Console and Secure Access Client Fixes
NetScaler Console receives the most serious management-plane fix. CVE-2026-120869, rated 9.4, is an unauthenticated access-control bypass, and Citrix fixed it in version 14.1-74.34. Because the Console manages NetScaler fleets, an unauthenticated bypass there reaches further than a flaw on a single appliance.
Local Privilege Escalation in Windows and Linux Clients
Two local privilege escalation bugs in the Secure Access Client for Windows and Linux are also fixed. These require a foothold on the endpoint, but they matter on shared or managed workstations where users hold limited rights.
AI-Assisted Code Review and the Exploitation Record
Citrix said the review that surfaced these flaws used AI-assisted code analysis. The company reports no known exploitation and no confirmed public proof-of-concept code.
The absence of exploitation does not make the products low-risk targets. CISA’s Known Exploited Vulnerabilities catalog added six NetScaler CVEs from 2026 between March and October, which shows that attackers have repeatedly turned NetScaler disclosures into working attacks. The November 5 Citrix release covered XenServer and Scout and is separate from this one.
Why Edge Devices Draw Repeated Attention
NetScaler ADC and Gateway sit on the internet boundary, handling VPN, load balancing and remote access. A memory flaw in a protocol parser such as DNS, SMPP or ICA proxy is reachable by anyone who can send traffic to the service, and denial-of-service outcomes alone can cut off remote workforces.
The scale of this batch, with 28 memory flaws in one release, also reflects how much code those appliances run. The use of AI-assisted analysis in the review points to a likely trend: vendors scanning their own codebases in bulk will surface more bugs at once, and customers will receive larger advisories than in past cycles. Organizations running NetScaler need to map their builds against the fixed versions listed above, starting with internet-facing ADC and Gateway instances and the Console that manages them.
Reading the Advisory Count Discrepancies
The differences between outlets, nine versus ten critical flaws and 12 versus 28 total, come from how each tallies the bulletins. The 31 CVEs across four bulletins is the figure that covers ADC, Gateway, Console and the Secure Access Client together, while the 28 refers to the memory flaws in ADC and Gateway alone.
Which Builds Administrators Should Check First
Administrators running ADC or Gateway in default configurations should check CVE-2026-120868 first, since Citrix says it affects every deployment. Those who manage fleets through NetScaler Console should apply the 14.1-74.34 fix, because the unauthenticated bypass in CVE-2026-120869 targets the system that administers the appliances themselves.
