xtralinux

November 13, 2026 / news

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Console Authentication Bypass and Root Privilege Escalation

Citrix fixed 12 flaws across NetScaler ADC, Gateway, Console and Secure Access Client: memory-overflow DoS bugs up to CVSS 9.5, a 9.4 Console authentication bypass, and root escalation in the Linux client. No exploits known.

Title: Citrix Ships 12 Fixes for NetScaler ADC, Gateway, Console and Secure Access Client — Update to 14.1-73.57 and Later

Summary: Citrix has released security updates for twelve vulnerabilities across NetScaler ADC, Citrix NetScaler Gateway, NetScaler Console and Secure Access Client for Windows and Linux. The critical memory-overflow batch for NetScaler ADC and Gateway all lead to unpredictable behavior or denial of service: CVE-2026-120868 in Packet Processing (CVSS 9.3, affects all deployments); CVE-2026-107407 in SMPP traffic (9.3, SMPP virtual servers); CVE-2026-107408 in DNS/DNS-over-HTTPS (9.3, DNS load balancing with recursive resolution); CVE-2026-107409 in DoH (9.3, DNS load balancing over HTTPS); CVE-2026-107410 in NetScaler Push (9.3, PUSH virtual servers); CVE-2026-107412 (9.5, multiple memory overflows on Gateway or AAA virtual servers); CVE-2026-107415 in Email OTP authentication (9.3, Email Action configuration); CVE-2026-111344 in Endpoint Analysis EPA/EPAS (9.3, VPN or AAA virtual servers with EPA); and CVE-2026-120864 in ICA proxy (9.3, Gateway VPN, AAA or HDX CR virtual servers). Also fixed: CVE-2026-120869 (CVSS 9.4), an improper-authentication flaw in NetScaler Console letting an unauthenticated attacker bypass authentication to reach restricted resources, fixed in Console 14.1-74.34 and later; CVE-2026-118268 (8.5), letting a low-privileged Windows user escalate to SYSTEM via Secure Access Client, fixed in 26.11.1.6 and later; and CVE-2026-118269 (8.5), letting a low-privileged Linux user gain root through Secure Access Client for Linux, fixed in 26.10.4 and later. Patched builds: NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, 14.1-FIPS 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later. Citrix says it is not aware of any exploits for the announced flaws and describes the batch as the product of an AI-assisted code review meant to harden NetScaler before threats materialize — but these are internet-facing appliances, so apply the updates promptly.

References:

← All news