Citrix’s parent company, Cloud Software Group, has shipped fixes for 28 security vulnerabilities in NetScaler ADC and NetScaler Gateway, publishing bulletin CTX697305 on November 12, 2026. Most of the flaws only matter if a specific feature is enabled, but one of them does not care about configuration at all — and that distinction is what makes this patch cycle more urgent than most.

The Flaw That Affects Everyone

CVE-2026-120868 is a memory overflow in NetScaler’s packet-processing code, rated Critical with a CVSS v4.0 score of 9.3. Unlike the vast majority of NetScaler bugs, which only expose a device if a particular virtual server type or authentication method is configured, this one requires nothing extra. Every unpatched NetScaler ADC or Gateway appliance is exposed in its default state, with no login and no user interaction needed to attempt exploitation. Successful exploitation can trigger unpredictable device behavior or a denial-of-service condition — and because the attack surface is universal, Citrix is not offering a workaround for this particular flaw. The only fix is to upgrade.

A Long List of Feature-Specific Bugs

The remaining 27 vulnerabilities are predominantly memory-safety issues — buffer overflows, out-of-bounds writes, and at least one double-free — that only become exploitable when a matching feature is actively configured. The highest-severity entry among these, CVE-2026-107412, scores 9.5 and affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.

Several more vulnerabilities also score 9.3, touching areas including SMPP traffic handling, DNS and DNS-over-HTTPS processing, NetScaler Push notifications, email one-time-password login, Endpoint Analysis, and ICA proxy functionality. A broader set of bugs rated 8.7 spans SAML authentication, WebAuth, LDAP, client-certificate login, HTTP/3, GSLB, Diameter, MQTT, and RADIUS handling — a list that covers much of NetScaler’s authentication and traffic-management surface. A BGP routing-related flaw scores lower, at 7.7, because it requires the attacker to already be, or convincingly impersonate, a configured BGP neighbor.

Three lower-severity flaws round out the bulletin at 6.9, including CVE-2026-111338, which writes sensitive login information into the local log file /var/log/httperror.log — a risk primarily for anyone who already has local read access to the appliance.

Who Needs to Patch, and How

The bulletin applies to customer-managed NetScaler deployments running version 14.1 before build 14.1-73.57, and 13.1 before build 13.1-64.39, along with their FIPS and NDcPP-certified counterparts. Cloud Software Group says it is separately updating its own managed cloud services and Adaptive Authentication offering, and that hybrid Secure Private Access deployments relying on customer-managed NetScaler instances will also need the update applied.

For the 27 configuration-dependent flaws, administrators can narrow down their exposure by searching their NetScaler configuration for specific entries Citrix lists in the bulletin, such as add vpn vserver or add authentication samlAction. That exercise is useful for prioritizing follow-up hardening work, but Citrix is explicit that it shouldn’t delay the core patch — since the critical, default-configuration flaw affects every deployment regardless of what else is turned on.

Citrix credited researchers from JPMorgan Chase’s XOR security team, Capital One’s offensive security group, and watchTowr with reporting several of the issues, while noting that its own product security team identified a number of the bugs using AI-assisted code analysis — a sign that AI-driven static analysis tools are starting to surface long-standing memory-safety issues in mature, widely deployed codebases.

Why the Urgency Is Warranted

NetScaler has had a difficult year. Citrix patched two actively exploited zero-days in the product line back in October, one of which CISA added to its Known Exploited Vulnerabilities catalog, and the earlier “CitrixBleed 2” flaw was tied to follow-on ransomware deployments after attackers exploited it in the wild. Given that history, security teams should expect attacker interest in this new batch of flaws to move quickly once the patch details become public.

Administrators are advised to upgrade to the fixed builds without delay, cross-check their configuration against the full CVE list in the bulletin, and ensure management-plane addresses (NSIP) are not reachable from untrusted networks, since at least one of the high-severity flaws, CVE-2026-120863, can be reached through that interface. Teams needing more detail can consult the full Citrix Security Bulletin and report related issues directly to Citrix’s security team.