Overview
Citrix has released security updates for 12 vulnerabilities affecting NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client. Several NetScaler flaws carry CVSS scores above 9.0, with potential impacts ranging from denial-of-service to authentication bypass and privilege escalation. Citrix says it is not currently aware of exploitation, but organisations using these products should treat the updates as high priority.
What Was Fixed
Nine critical NetScaler ADC and Gateway vulnerabilities involve memory overflows or corruption affecting services including packet processing, SMPP, DNS/DoH, NetScaler Push, Gateway/AAA, Email OTP, Endpoint Analysis and ICA Proxy. The most severe, CVE-2026-107412, has a CVSS score of 9.5 and affects Gateway or AAA configurations. A separate NetScaler Console vulnerability, CVE-2026-120869, carries a 9.4 score and could allow an unauthenticated attacker to bypass authentication controls and access restricted resources.
Endpoint Risk
Citrix also fixed privilege-escalation vulnerabilities in Secure Access Client for Windows and Linux. CVE-2026-118268 and CVE-2026-118269, both rated 8.5, could allow a low-privileged user to escalate to SYSTEM on Windows or root on Linux. These issues are particularly relevant to organisations using Citrix clients across managed endpoints.
Why It Matters
NetScaler frequently sits directly on the internet as a VPN gateway, authentication service, reverse proxy or application delivery platform, making vulnerabilities in these systems particularly attractive to attackers. Even flaws primarily described as denial-of-service risks can become operationally serious when they affect remote access, authentication or critical application delivery infrastructure.
What IT Teams Should Do
Administrators should inventory all NetScaler ADC, NetScaler Gateway and Console deployments and confirm whether features such as Gateway, AAA, DNS/DoH, EPA, ICA Proxy or Email OTP are enabled. Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later or the applicable supported 13.1 release, NetScaler Console to 14.1-74.34 or later, Secure Access Client for Windows to 26.11.1.6 or later, and the Linux client to 26.10.4 or later. After patching, review authentication and administrative logs for unusual activity.
Expert in the Cloud Insight
Internet-facing infrastructure deserves priority treatment during every patch cycle. NetScaler is often the front door to an organisation’s applications and remote-access environment, so a compromise can potentially provide an attacker with a strategic position before they ever reach an internal server. Maintain accurate configuration inventories, minimise exposed management interfaces, enforce MFA and privileged access controls, and treat critical gateway appliances as part of the organisation’s primary security boundary.
Expert in the Cloud – The Future Is Now.
Leave a Reply