On this page
Citrix published 28 security fixes for NetScaler ADC and NetScaler Gateway on November 12, 2026, and one of them, CVE-2026-120868, hits every customer-managed NetScaler in its default configuration. Someone on the internet who can send traffic to the box can make it crash or misbehave. NetScaler Gateway is the login page many companies put in front of remote desktops, VPN and Citrix apps, so when it goes down, people can't work. Citrix reports no attacks yet. Patch anyway: two NetScaler bulletins this fall were under attack within days of release.
The fix is one firmware upgrade: 14.1-73.58 or 13.1-64.39, or the FIPS builds listed below. There is no workaround. This post is the operator read of Citrix bulletin CTX697305. The HOL Guard evidence pack for CVE-2026-120868 is the source record.
How to fix
Upgrade every customer-managed NetScaler ADC and NetScaler Gateway, both nodes of each HA pair, to one of these builds:
- 14.1: 14.1-73.58 or later. The bulletin names 14.1-73.57 as the first fixed build, but the build Citrix posted for download is 14.1-73.58.
- 13.1: 13.1-64.39 or later.
- 14.1-FIPS: 14.1-73.58 FIPS or later.
- 13.1-FIPS and 13.1-NDcPP: 13.1-37.293 or later.
Check the running build from the NetScaler CLI:
show ns versionAnything below the builds above is vulnerable to CVE-2026-120868 whatever you have configured. NetScaler 12.1 and 13.0 are end of life and get no fix, so treat them as vulnerable and move to 14.1.
If you manage the fleet from NetScaler Console, Citrix shipped a Console update the same day. Upgrade Console first, then the appliances. The Console got its own critical login-bypass fix the same day (CVE-2026-120869) that we judged separately: it usually sits on an internal network, unlike the Gateway.
The October patch is not enough
This is the fifth NetScaler bulletin since late September. If you upgraded to 14.1-73.49 or 13.1-64.32 in late October, you are vulnerable again. Those builds predate this bulletin. Thomas Poppelgaard, who maintains a widely used NetScaler checker, flags exactly this: a box his v1.18 checker called clean now fails under v1.19. The new builds roll up every earlier 2026 NetScaler fix, so there is one target, not five.
Why a "denial of service" label undersells it
Citrix's text for CVE-2026-120868 says "unpredictable or erroneous behavior or Denial of Service." Its own score says more. The CVSS v4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H: reachable over the network, no login, no user action, and high impact on confidentiality and integrity as well as availability. A pure crash bug scores VC:N/VI:N.
Compare the SAML memory overflow from October. CVE-2026-88779 was scored availability-only at 8.7, needed SAML configured, and CISA still put it on the exploited list the day after Citrix disclosed it. CVE-2026-120868 needs no feature, scores 9.3, and Citrix rates the data impact high. We would not wait for a KEV entry on this one.
What else is in CTX697305
Most of the other 27 CVEs only apply if a feature is turned on. The ones that matter for the most common setup, NetScaler as a Gateway or AAA login page, are:
- CVE-2026-107412 (CVSS v4.0 9.5): several memory overflows on any Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- CVE-2026-120864 (9.3): memory overflow in ICA proxy on Gateway, AAA or HDX virtual servers.
- CVE-2026-111344 (9.3): memory overflow in Endpoint Analysis on VPN or AAA virtual servers with EPA.
- CVE-2026-111342 (8.7) and CVE-2026-111343 (6.9): memory overflows in LDAP and in authentication request handling on Gateway or AAA.
The rest are tied to SAML, WebAuth, Email OTP, KBA, client certificates, DNS and DNS-over-HTTPS, SMPP, Push, RTSP, Diameter/SIP/MQTT/RADIUS load balancing, HTTP/2, HTTP/3, Base64 policies and Application Firewall, GSLB, SIP ALG, BGP, ECH and SafeNet HSM, plus one in the management plane (CVE-2026-120863, 8.7) that needs a route to the NSIP. Because CVE-2026-120868 covers every box, the feature list doesn't change the answer: upgrade.
One item is not a memory bug: CVE-2026-111348 writes authentication material to a log file. Upgrading stops new writes, but httperror.log files and support bundles collected before the upgrade can still hold it. Treat old bundles you sent to support or stored in tickets as sensitive.
Who is not in scope
- Citrix-managed cloud services and Citrix-managed Adaptive Authentication. Cloud Software Group upgrades those itself.
- Appliances already on 14.1-73.58, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS/NDcPP.
Do not read the cloud carve-out as covering Secure Private Access Hybrid. Citrix says hybrid deployments that use NetScaler instances are affected, and you upgrade those appliances yourself.
What this is not
It is not a known attack yet: Citrix reports no exploitation, it is not on CISA's Known Exploited Vulnerabilities catalog as of this writing, and we found no public exploit. It is also not CitrixBleed or the September remote code execution bug, CVE-2026-88771, which was exploited before many owners patched. If CISA adds any CTX697305 bug to KEV, we will post a follow-up. Every NetScaler CVE we track, including the other 27 in this bulletin, is listed in the HOL Guard CVE feed.
What do people ask about CVE-2026-120868?
Which NetScaler versions fix CVE-2026-120868?
NetScaler ADC and Gateway 14.1-73.58, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP, or later. Citrix's bulletin names 14.1-73.57 as the first fixed 14.1 build, and 14.1-73.58 is the build available to download.
Is CVE-2026-120868 being exploited?
Not as of November 12, 2026. Citrix reports no exploitation and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Is there a workaround for CVE-2026-120868?
No. It affects the default configuration and no feature has to be enabled, so there is nothing to turn off. Upgrading is the only fix.
Are Citrix cloud customers affected?
Citrix-managed cloud services and Citrix-managed Adaptive Authentication are patched by Cloud Software Group. Customer-managed appliances, including NetScaler instances in Secure Private Access Hybrid deployments, need to be upgraded by their owners.
I patched NetScaler in October. Am I covered?
No. Builds 14.1-73.49 and 13.1-64.32 from late October are below the new fixed builds and are vulnerable to CVE-2026-120868.
Related
- Unauthenticated NetScaler RCE hits every appliance (CVE-2026-88771)
- NetScaler SAML memory overflow hits CISA KEV (CVE-2026-88779)
- Barracuda email gateways exploited, on CISA KEV (CVE-2026-116606)
- BeyondTrust Remote Support file upload on CISA KEV (CVE-2026-102764)
