Citrix patches critical flaws in NetScaler products

Citrix has released patches addressing 28 NetScaler ADC and NetScaler Gateway vulnerabilities, including nine rated as critical. The fixes cover memory overflow flaws across multiple components, including Packet Processing, SMPP traffic, DNS / DNS-over-HTTPS (DoH), NetScaler Push, Email OTP authentication, Endpoint Analysis (EPA/EPAS), and ICA proxy. The vulnerabilities could enable unpredictable behaviour or denial-of-service conditions.

Citrix lists CVEs as CVE-2026-120868, CVE-2026-107407 to CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334 and CVE-2026-120864. A further high‑severity defect, CVE-2026-111338, could expose sensitive authentication material in a log file.

Affected products include NetScaler ADC and Gateway versions 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later. The patches also cover NetScaler Console vulnerabilities, with CVE-2026-120869 (CVSS 9.4) potentially allowing unauthenticated attackers to bypass controls and access restricted resources; this defect affects all NetScaler Console 14.1 releases prior to 14.1-74.34.

Citrix states that none of these flaws have been reported as exploited in the wild, but notes that NetScaler‑related vulnerabilities are frequent targets for threat actors, and urges customers to update as soon as possible.