---
title: Citrix patches a batch of critical NetScaler ADC/Gateway memory bugs, one hitting default configurations, plus a NetScaler Console auth bypass (CVE-2026-120869) | ctxsec
url: https://ctxsec.com/items/citrix-netscaler-ctx697305-nov-12-2026-cve-2026-120868-default-config-console-auth-bypass
description: "Citrix's Nov 12 bulletin fixes a set of critical memory overflow and corruption flaws in customer-managed NetScaler ADC and Gateway. The widest is CVE-2026-120868 (CVSS 9.3) in packet processing, which affects every deployment including the default configuration; others need specific features such as Gateway/AAA virtual servers (CVE-2026-107412, 9.5), Email OTP, Endpoint Analysis, ICA proxy, DNS/DoH, SMPP or Push. Citrix describes the impact as unpredictable behavior or denial of service. Fixed builds: 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP. The same release fixes CVE-2026-120869 (9.4), an unauthenticated authentication bypass in NetScaler Console (fixed in 14.1-74.34), and SYSTEM/root privilege escalation in Secure Access Client for Windows (26.11.1.6) and Linux (26.10.4)."
status: "official (Citrix bulletin CTX697305 and NetScaler Security Advisory listing, Nov 12, 2026); Citrix says it is not aware of exploits"
published: 2026-11-12
---

> Citrix's Nov 12 bulletin fixes a set of critical memory overflow and corruption flaws in customer-managed NetScaler ADC and Gateway. The widest is CVE-2026-120868 (CVSS 9.3) in packet processing, which affects every deployment including the default configuration; others need specific features such as Gateway/AAA virtual servers (CVE-2026-107412, 9.5), Email OTP, Endpoint Analysis, ICA proxy, DNS/DoH, SMPP or Push. Citrix describes the impact as unpredictable behavior or denial of service. Fixed builds: 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP. The same release fixes CVE-2026-120869 (9.4), an unauthenticated authentication bypass in NetScaler Console (fixed in 14.1-74.34), and SYSTEM/root privilege escalation in Secure Access Client for Windows (26.11.1.6) and Linux (26.10.4).

[← Cybersecurity News](/news) · [markdown](/items/citrix-netscaler-ctx697305-nov-12-2026-cve-2026-120868-default-config-console-auth-bypass.md)

official (Citrix bulletin CTX697305 and NetScaler Security Advisory listing, Nov 12, 2026); Citrix says it is not aware of exploits

2026-11-12 11:37 AM ET

### Citrix patches a batch of critical NetScaler ADC/Gateway memory bugs, one hitting default configurations, plus a NetScaler Console auth bypass (CVE-2026-120869)

- **Do now:** schedule the ADC/Gateway upgrade, starting with internet-facing Gateway and AAA virtual servers; upgrade NetScaler Console and keep its management interface off the internet.
- **Also affected:** Secure Private Access hybrid deployments using NetScaler instances. Citrix-managed cloud services are being upgraded by Citrix.
- **Context:** Citrix says the fixes came from an AI-assisted code review, and it is not aware of exploits. NetScaler memory bugs have been exploited quickly in the past, so don't wait for a KEV listing.
- NetScaler Console's Security Advisory dashboard can flag affected instances by version scan.

Sources: [Citrix Security Bulletin CTX697305: Citrix NetScaler ADC and NetScaler Gateway (Nov 12, 2026; text mirrored by CIRCL)](https://cve.circl.lu/bundles/) · [NetScaler docs: Security Advisory supported CVEs (lists Nov 12, 2026 bulletin CVEs)](https://docs.netscaler.com/us/en/netscaler-application-delivery-management-software/current-release/infrastructure/security-advisory-dashboard/supported-cve.html) · [The Hacker News: Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass (Nov 12, 2026)](https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html)