Citrix patches a batch of critical NetScaler ADC/Gateway memory bugs, one hitting default configurations, plus a NetScaler Console auth bypass (CVE-2026-120869)
- Do now: schedule the ADC/Gateway upgrade, starting with internet-facing Gateway and AAA virtual servers; upgrade NetScaler Console and keep its management interface off the internet.
- Also affected: Secure Private Access hybrid deployments using NetScaler instances. Citrix-managed cloud services are being upgraded by Citrix.
- Context: Citrix says the fixes came from an AI-assisted code review, and it is not aware of exploits. NetScaler memory bugs have been exploited quickly in the past, so don't wait for a KEV listing.
- NetScaler Console's Security Advisory dashboard can flag affected instances by version scan.
Sources: Citrix Security Bulletin CTX697305: Citrix NetScaler ADC and NetScaler Gateway (Nov 12, 2026; text mirrored by CIRCL) · NetScaler docs: Security Advisory supported CVEs (lists Nov 12, 2026 bulletin CVEs) · The Hacker News: Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass (Nov 12, 2026)