Citrix fixes 31 flaws across NetScaler products

Cloud Software Group has issued four Citrix security bulletins that fix 31 CVEs in Citrix NetScaler products, with the majority of fixes targeting NetScaler ADC and NetScaler Gateway. The NetScaler ADC and Gateway patches are 14.1-73.57 and 13.1-64.39, addressing 28 memory-related flaws (some allowing Denial of Service or unpredictable behaviour) with CVSS up to 9.5.

Citrix also released a NetScaler Console fix (14.1-74.34) for an authentication-bypass issue rated at 9.4, and updated Secure Access Client builds for Windows and Linux to remediate two local privilege escalation bugs. Citrix reports no exploitation or public PoCs confirmed at the time of the advisories.

Notable CVEs highlighted include CVE-2026-120868 and CVE-2026-120869, both affecting NetScaler ADC and Gateway, with CVE-120868 described as a core packet-processing memory overflow and CVSS 9.3, and CVE-120869 (Console) scoring 9.4 as an unauthenticated bypass of authentication controls. CVE-107412 is listed as the highest severity at 9.5 and covers multiple memory-overflow flaws impacting gateway/AAA configurations.

The default-configuration vulnerability is emphasised, affecting all NetScaler ADC and Gateway deployments, including those with default settings. Affected versions include 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39, with additional FIPS/NDcPP and console/client build restrictions. Administrators are urged to apply fixed builds promptly and to prioritise internet-facing Gateway and AAA appliances, while monitoring for CISA KEV updates. No exploitation is reported yet in the article, and no public PoCs are confirmed.