{"id":4225,"date":"2026-11-13T06:49:15","date_gmt":"2026-11-13T14:49:15","guid":{"rendered":"https:\/\/cyber.mag212.com\/citrix-netscaler-adc-gateway-28-cves-cve-2026-120868-console-cve-2026-120869\/"},"modified":"2026-11-13T06:49:15","modified_gmt":"2026-11-13T14:49:15","slug":"citrix-netscaler-adc-gateway-28-cves-cve-2026-120868-console-cve-2026-120869","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/citrix-netscaler-adc-gateway-28-cves-cve-2026-120868-console-cve-2026-120869\/","title":{"rendered":"Citrix NetScaler\u00a0: 28 failles dans l\u2019ADC et la passerelle, dont une affectant chaque appliance, et une solution de contournement de la console 9.4"},"content":{"rendered":"\n

NetScaler appliances carry remote access and application traffic for a large share of the world\u2019s enterprises, and their vulnerabilities have a history of being exploited quickly. This week Citrix fixed 28 of them in a single ADC and Gateway bulletin. Most need a particular feature to be switched on, but one, CVE-2026-120868, affects every deployment including the default configuration. A separate bulletin fixes an unauthenticated bypass in NetScaler Console, the management tool many teams use to run their fleets. Citrix does not report exploitation of any of them.<\/p>\n\n\n\n

Every appliance<\/strong><\/td>CVE-2026-120868, packet processing, 9.3<\/td><\/tr>
Highest score<\/strong><\/td>CVE-2026-107412, Gateway\/AAA, 9.5<\/td><\/tr>
Fix ADC\/Gateway<\/strong><\/td>14.1-73.57 \u00b7 13.1-64.39 \u00b7 FIPS 14.1-73.58 \/ 13.1-37.293<\/td><\/tr>
Console<\/strong><\/td>CVE-2026-120869, 9.4 \u00b7 fix 14.1-74.34<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

[Confirmed]<\/strong> Citrix bulletin CTX697305 lists 28 CVEs<\/strong> in NetScaler ADC and Gateway, almost all memory-safety bugs that Citrix says “can lead to unpredictable or erroneous behavior or Denial of Service”. The one that matters to everyone is CVE-2026-120868<\/strong> (CVSS 4.0: 9.3), in core packet processing: all<\/strong> deployments are affected, “including those deployed with the default configuration”. The highest score, 9.5, goes to CVE-2026-107412<\/strong>, a set of memory overflows on appliances configured as a Gateway<\/strong> (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server<\/strong>. Separately, CTX697320 fixes CVE-2026-120869<\/strong> (9.4), an unauthenticated bypass in NetScaler Console<\/strong>. (CTX697305<\/a>) (CTX697320<\/a>)<\/p>\n\n\n\n

[Confirmed]<\/strong> Neither bulletin reports exploitation. Credits include JPMorgan Chase’s XOR team, CapitalOne and watchTowr, and Citrix says it found several issues itself with AI-assisted code analysis. Secure Private Access hybrid deployments that use NetScaler instances also need the upgrade; Citrix-managed cloud services are patched by Citrix. (Citrix<\/a>) [MAG212 analysis]<\/strong> NetScaler bugs have been weaponised quickly in past years, and watchTowr often publishes technical detail after a patch, so don’t treat “not exploited” as “not urgent”.<\/p>\n\n\n\n

\"Matrix
Figure 3 \u00b7 Which NetScaler CVEs apply to you.<\/strong> One flaw hits every appliance; the rest depend on features. Every node below the fixed build needs the upgrade. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Who is affected<\/h2>\n\n\n\n

[Confirmed]<\/strong> NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1-FIPS before 14.1-73.58 and 13.1-FIPS\/NDcPP before 13.1-37.293. Console 14.1 before 14.1-74.34. The Console flaw needs network access to the Console IP (attack vector “adjacent”). Other notable preconditions include a management-plane flaw exploitable by any untrusted host that can reach the NSIP (CVE-2026-120863), and authentication material written to \/var\/log\/httperror.log<\/code> after logouts (CVE-2026-111338). (Citrix<\/a>)<\/p>\n\n\n\n

Build and exposure check<\/h3>\n\n\n\n

OS: NetScaler 13.1 \/ 14.1 \u00b7 Shell: NetScaler CLI, then shell \u00b7 Privileges: nsroot or read-only admin \u00b7 READ-ONLY<\/em><\/p>\n\n\n\n

# CLI: running build (run on every node, both HA peers)\nshow ns version\n# shell: features that widen exposure (patterns from CTX697305)\nshell\ngrep -E '^add (vpn|authentication) vserver' \/nsconfig\/ns.conf\ngrep -E 'http2 ENABLED|B64DECODE' \/nsconfig\/ns.conf\nexit<\/code><\/pre>\n\n\n\n
Compare the build with the fixed versions above; every node below them needs the upgrade regardless of the grep results, because CVE-2026-120868 hits default configurations. The grep results show which extra CVEs apply. Commands not tested by MAG212 CYBER<\/strong>; patterns follow CTX697305<\/a> and NetScaler docs<\/a>.<\/p>\n\n\n\n
Contain, remediate and verify<\/h2>\n\n\n\n
    \n
  1. Upgrade internet-facing Gateway and AAA appliances first<\/strong>, then everything else, then Console. Back up the configuration before each upgrade.<\/li>\n\n\n
  2. Restrict NSIP and Console access<\/strong> to management networks (this addresses CVE-2026-120863 and CVE-2026-120869 exposure).<\/li>\n\n\n
  3. [MAG212 analysis]<\/strong> Treat old httperror.log<\/code> files as sensitive<\/strong> (CVE-2026-111338): limit who can read them and consider rotating credentials if they were copied off-box.<\/li>\n\n<\/ol>\n\n\n\n
    Verify recovery:<\/strong> both HA peers report the fixed build, HA sync is healthy, VPN and SSO logins work, and a test from an untrusted segment can’t reach the Console. Prevention<\/strong> [MAG212 analysis]<\/strong>: subscribe to Citrix bulletin alerts, and keep a list of which features each appliance uses, so the next precondition check takes minutes.<\/p>\n\n\n\n
    Planning the rollout<\/h2>\n\n\n\n
    [MAG212 analysis]<\/strong> Because one flaw affects every appliance, the question is not whether to upgrade but in what order. Internet-facing Gateway and AAA virtual servers come first: they carry the highest-scoring flaw and sit where attackers look first. Internal load balancers come next, then Console.<\/p>\n\n\n\n
    [MAG212 analysis]<\/strong> High-availability pairs make NetScaler upgrades routine but not trivial. Upgrade the secondary, fail over, confirm VPN and SSO logins work, then upgrade the former primary. Keep a configuration backup from before each step, and schedule the work in a window when a failed login is noticed quickly.<\/p>\n\n\n\n
    [MAG212 analysis]<\/strong> Citrix credits external researchers including watchTowr, which has published detailed technical analyses of past NetScaler patches. Whether or not that happens here, defenders should assume the time between a NetScaler patch and a working exploit can be short.<\/p>\n\n\n\n
    Why it matters<\/h2>\n\n\n\n
    NetScaler Gateway is the front door to remote work for many organisations, and past NetScaler flaws such as CitrixBleed were used to steal sessions and breach large networks within weeks of disclosure. A flaw that affects default configurations removes the comfort of \u201cwe don\u2019t use that feature\u201d. Console is just as sensitive: it holds credentials and configuration for every appliance it manages.<\/p>\n\n\n\n
    The bottom line<\/h2>\n\n\n\n
    Upgrade every NetScaler ADC and Gateway to 14.1-73.57 or 13.1-64.39 (FIPS: 14.1-73.58 or 13.1-37.293), starting with internet-facing Gateway and AAA, then move Console to 14.1-74.34. Restrict NSIP and Console access to management networks, treat old httperror.log files as sensitive, and confirm both HA peers report the fixed build.<\/p>\n\n\n\n
    How we label evidence: [Confirmed]<\/strong> comes from a primary source such as a vendor or CISA; [Reported]<\/strong> from a secondary outlet; [Claimed]<\/strong> from an attacker or an unverified party; [MAG212 analysis]<\/strong> is our judgement; [Unknown]<\/strong> means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.<\/em><\/p>\n\n\n\n
    \n\n\n\n
    This story is part of MAG212 CYBER Daily, 13 November 2026<\/a>, with the day\u2019s other verified stories, the Defender\u2019s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER<\/a>. By El Mostafa Ouchen.<\/p>\n\n","protected":false},"excerpt":{"rendered":"
    Citrix bulletin CTX697305 fixes 28 CVEs in NetScaler ADC and Gateway, including CVE-2026-120868 (9.3), which affects default configurations, and CVE-2026-107412 (9.5) on Gateway and AAA. A separate bulletin fixes a 9.4 authentication bypass in NetScaler Console. Fixed builds, preconditions and a rollout plan.<\/p>","protected":false},"author":1,"featured_media":4223,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,14],"tags":[335,348,107,323,349],"class_list":["post-4225","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-vulnerabilities","tag-citrix","tag-netscaler","tag-patch-management","tag-remote-access","tag-vpn-security"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4225"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4225\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4223"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}