Citrix has released security updates addressing 12 vulnerabilities affecting NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client for Windows and Linux.
The flaws include critical memory overflow and memory corruption vulnerabilities that could trigger denial-of-service (DoS) conditions, as well as security weaknesses that could allow attackers to bypass authentication controls or escalate system privileges.
Nine of the vulnerabilities affect NetScaler ADC and NetScaler Gateway, with several carrying CVSS severity scores of 9.3 and 9.5.
The affected vulnerabilities include:
– CVE-2026-120868 (CVSS 9.3): A memory overflow flaw in packet processing that could cause unexpected system behaviour or denial-of-service conditions. It affects all NetScaler ADC and NetScaler Gateway deployments.
– CVE-2026-107407 (CVSS 9.3): A memory overflow vulnerability involving SMPP traffic that could result in unpredictable behaviour or service disruption. It affects NetScaler ADC deployments configured with an SMPP-type Load Balancing or Content Switching virtual server.
– CVE-2026-107408 (CVSS 9.3): A memory corruption flaw affecting DNS and DNS-over-HTTPS (DoH), potentially leading to unexpected behaviour or denial of service. It applies to NetScaler ADC configured for DNS load balancing and recursive DNS resolution.
– CVE-2026-107409 (CVSS 9.3): A memory corruption vulnerability in DNS-over-HTTPS that could cause unpredictable behaviour or denial of service. It affects NetScaler deployments configured for DNS load balancing over HTTPS.
– CVE-2026-107410 (CVSS 9.3): A memory overflow issue in NetScaler Push that could lead to system instability or denial of service. It affects deployments configured with a PUSH-type Load Balancing virtual server.
– CVE-2026-107412 (CVSS 9.5): Multiple memory overflow vulnerabilities that could cause unpredictable system behaviour and denial-of-service conditions. The affected configurations include NetScaler Gateway and AAA virtual servers.
– CVE-2026-107415 (CVSS 9.3): A memory overflow flaw in Email One-Time Password (OTP) authentication that could trigger unexpected behaviour or denial of service. It affects NetScaler ADC and NetScaler Gateway deployments configured with an Email Action.
– CVE-2026-111344 (CVSS 9.3): A memory overflow vulnerability in Endpoint Analysis (EPA/EPAS) that could result in system instability or denial of service. It affects NetScaler VPN and authentication (AAA) virtual server configurations that use Endpoint Analysis.
– CVE-2026-120864 (CVSS 9.3): A memory overflow vulnerability in ICA proxy that could cause unpredictable behaviour or denial of service. It affects NetScaler deployments configured as Gateway VPN virtual servers, AAA virtual servers or HDX-type Content Redirection (CR) virtual servers.
Citrix confirmed that fixes for these vulnerabilities are available in the following releases:
-
NetScaler ADC and NetScaler Gateway 14.1-73.57 and later.
-
NetScaler ADC and NetScaler Gateway 13.1-64.39 and subsequent 13.1 releases.
-
NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS and later releases.
-
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later releases.
Additional vulnerabilities affect NetScaler Console and Secure Access Client
Citrix also addressed three other security vulnerabilities affecting NetScaler Console and Secure Access Client applications for Windows and Linux.
CVE-2026-120869 carries a CVSS score of 9.4 and involves improper authentication handling in NetScaler Console. The flaw could allow an unauthenticated attacker to bypass authentication protections and gain access to restricted resources on the appliance.
The vulnerability has been fixed in NetScaler Console version 14.1-74.34 and later releases.
Another flaw, CVE-2026-118268, has a CVSS score of 8.5 and affects Secure Access Client for Windows. It is caused by improper privilege management and could enable a user with limited permissions to escalate privileges to SYSTEM level.
The issue is resolved in Secure Access Client for Windows version 26.11.1.6 and later.
Similarly, CVE-2026-118269, also rated 8.5, affects Secure Access Client for Linux. It could allow a low-privileged user to obtain root privileges because of improper privilege management.
Citrix has addressed the Linux vulnerability in Secure Access Client version 26.10.4 and subsequent releases.
AI-assisted security review
Citrix said the latest security updates followed a broader examination of its software codebase, incorporating artificial intelligence-assisted code analysis to identify and fix vulnerabilities.
The company said the initiative is intended to strengthen the security of its products and address weaknesses before they can be exploited by potential attackers.
Citrix disclosed that it was not aware of any active exploitation of the vulnerabilities at the time of publication.
However, the company urged customers to install the available security updates promptly, noting that the patches are designed to improve the overall security posture of NetScaler products and related services.
Organisations running affected NetScaler appliances or Secure Access Client installations should identify their deployed versions and upgrade to the appropriate fixed releases to reduce the risk of service disruption, authentication bypass and privilege escalation.