Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Unauthenticated Authentication Bypass

Citrix put out a batch of security updates on Nov. 12 covering 12 vulnerabilities in four products: NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client for Windows and Linux.

The company said it is not aware of any exploits for the flaws. It urged customers to install the updates anyway, saying they are designed to "enhance the security posture of NetScaler."

What was fixed

Nine of the 12 flaws hit NetScaler ADC and NetScaler Gateway. Each carries a CVSS score of 9.3 or 9.5. They are memory overflow and corruption bugs that can cause unpredictable behavior or denial of service in specific configurations.

The affected components include packet processing, SMPP, DNS/DoH, NetScaler Push, Gateway/AAA, Email OTP, Endpoint Analysis and ICA Proxy. The most severe is CVE-2026-107412, scored 9.5, which affects Gateway or AAA configurations.

Whether a given appliance is exposed depends on which features are switched on. A version check alone won't settle it.

A tenth flaw, CVE-2026-120869, is in NetScaler Console. It lets an unauthenticated attacker bypass authentication controls and reach restricted resources on the appliance. Rapid7's vulnerability database lists a CVSS 4.0 base score of 9.3, rated critical, with a network attack vector, low complexity, and no privileges or user interaction required. One other listing puts the score at 9.4.

The last two, CVE-2026-118268 and CVE-2026-118269, are privilege escalation bugs in Secure Access Client. Both are rated 8.5. A low-privileged user could climb to SYSTEM on Windows or root on Linux.

Fixed versions

The patched releases listed are:

• NetScaler ADC and Gateway: 14.1-73.57 or later, or the applicable supported 13.1 release
• NetScaler Console: 14.1-74.34 or later
• Secure Access Client for Windows: 26.11.1.6 or later
• Secure Access Client for Linux: 26.10.4 or later

Why the edge matters

NetScaler commonly runs as a VPN gateway, authentication service, reverse proxy or application delivery platform. That puts it directly on the internet. A denial-of-service bug on a box like that can cut off remote access for an entire workforce. An authentication bypass on a management console is a worse problem.

The guidance from the security community is consistent. Administrators should inventory every NetScaler ADC, Gateway and Console deployment, plus client installs. They should confirm which features are enabled, and put internet-facing Gateway, VPN virtual servers and Console at the front of the queue.

After patching, they should verify version numbers, review authentication and administrative logs for unusual activity, and tighten access to management interfaces.

The AI angle

Citrix said the release follows a deeper review of its codebase that integrated AI-assisted code analysis, with the goal of finding and fixing vulnerabilities before attackers could use them. The company has not said how many of the 12 flaws that analysis turned up, or how long the flaws were present in shipping code.

That is a fair question for customers. Nine critical-range memory bugs in one release suggest these weaknesses were sitting in the products for some time. Citrix has not said otherwise.

What comes next

No one has reported exploitation, and Citrix says it has none to report. That status can change once fixed builds are public and the details are picked over. The patches are available now. The open item is how fast customers with exposed NetScaler gear get them installed.