---
title: Tip: for the Nov 12 NetScaler fixes, patch Gateway/AAA appliances first and check Console exposure | ctxsec
url: https://ctxsec.com/items/tip-netscaler-nov-2026-patch-order-gateway-aaa-first-console-off-internet
description: "CVE-2026-120868 hits every NetScaler ADC and Gateway build before 14.1-73.57 / 13.1-64.39, so every appliance needs the upgrade. Start with appliances running Gateway or AAA virtual servers, which also carry CVE-2026-107412, Email OTP, Endpoint Analysis and ICA proxy bugs. Separately, confirm NetScaler Console's interface isn't reachable from untrusted networks until it is on 14.1-74.34."
status: "official guidance (Citrix bulletin CTX697305, Nov 12, 2026)"
published: 2026-11-12
---

> CVE-2026-120868 hits every NetScaler ADC and Gateway build before 14.1-73.57 / 13.1-64.39, so every appliance needs the upgrade. Start with appliances running Gateway or AAA virtual servers, which also carry CVE-2026-107412, Email OTP, Endpoint Analysis and ICA proxy bugs. Separately, confirm NetScaler Console's interface isn't reachable from untrusted networks until it is on 14.1-74.34.

[← Tips & Guides](/tips) · [markdown](/items/tip-netscaler-nov-2026-patch-order-gateway-aaa-first-console-off-internet.md)

official guidance (Citrix bulletin CTX697305, Nov 12, 2026)

2026-11-12 11:37 AM ET

### Tip: for the Nov 12 NetScaler fixes, patch Gateway/AAA appliances first and check Console exposure

- Use `show ns version` on each appliance and compare against the fixed builds.
- Don't forget FIPS/NDcPP builds and NetScaler instances behind Secure Private Access hybrid deployments.
- Push the Secure Access Client updates to endpoints too (privilege escalation to SYSTEM/root).

Sources: [Citrix Security Bulletin CTX697305: Citrix NetScaler ADC and NetScaler Gateway (Nov 12, 2026; text mirrored by CIRCL)](https://cve.circl.lu/bundles/) · [The Hacker News: Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass (Nov 12, 2026)](https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html)