CybersecurityVulnerability Management

Citrix Fixes Flaws in NetScaler, Secure Access Client

Analyst 207||Source: TheHackerNews
Network appliance on equipment rack with neatly managed cables and monitors.

CVE-2026-120868 — a memory overflow in packet processing rated CVSS 9.3 — is one of a dozen critical flaws Citrix has patched across NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client, vulnerabilities the vendor says could allow denial-of-service or authentication bypass under specific configurations.

Scope and severity of the NetScaler ADC and Gateway flaws

Citrix disclosed a set of high-severity vulnerabilities that affect NetScaler ADC and NetScaler Gateway in different configurations. The company assigned CVSS scores as high as 9.5 for the most serious issues and listed explicit functional triggers for each defect.

  • CVE-2026-120868 (CVSS 9.3): memory overflow in Packet Processing (affects all NetScaler ADC and NetScaler Gateway deployments).
  • CVE-2026-107407 (CVSS 9.3): memory overflow in SMPP traffic (affects NetScaler ADC configured with a Load Balancing or Content Switching virtual server of type SMPP).
  • CVE-2026-107408 (CVSS 9.3): memory corruption in DNS / DNS-over-HTTPS (affects NetScaler ADC configured for DNS load balancing and recursive DNS resolution).
  • CVE-2026-107409 (CVSS 9.3): memory corruption in DNS-over-HTTPS (affects NetScaler configured with DNS Load Balancing over HTTPS).
  • CVE-2026-107410 (CVSS 9.3): memory overflow in NetScaler Push (affects NetScaler configured as Load Balancing virtual server of type PUSH).
  • CVE-2026-107412 (CVSS 9.5): multiple memory overflow vulnerabilities (affect NetScaler configured as a Gateway or an AAA virtual server).
  • CVE-2026-107415 (CVSS 9.3): memory overflow in Email OTP authentication (affects NetScaler ADC or NetScaler Gateway configured with an Email Action).
  • CVE-2026-111344 (CVSS 9.3): memory overflow in Endpoint Analysis (EPA/EPAS) (affects NetScaler configured as a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis).
  • CVE-2026-120864 (CVSS 9.3): memory overflow in ICA proxy (affects NetScaler configured as a Gateway VPN virtual server, an AAA virtual server, or a CR virtual server of type HDX).

Patched product versions and editions

Citrix published explicit version milestones that contain the fixes. Administrators who manage NetScaler should compare their deployed release against these updates and plan upgrades where necessary:

  • Citrix NetScaler ADC and Citrix NetScaler Gateway: 14.1-73.57 and later releases.
  • Citrix NetScaler ADC and Citrix NetScaler Gateway: 13.1-64.39 and later releases of 13.1.
  • Citrix NetScaler ADC 14.1-FIPS: 14.1-73.58 FIPS and later releases of 14.1-FIPS.
  • Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.293 and later releases of 13.1-FIPS and 13.1-NDcPP.

NetScaler Console and Secure Access Client: authentication bypass and privilege escalation fixes

Citrix also addressed high-severity issues in management and endpoint components:

  • CVE-2026-120869 (CVSS 9.4): improper authentication in NetScaler Console that can allow an unauthenticated attacker to bypass authentication controls. Fixed in NetScaler Console 14.1-74.34 and later.
  • CVE-2026-118268 (CVSS 8.5): improper privilege management in Secure Access Client for Windows that can allow a low-privileged user to escalate to SYSTEM. Fixed in Secure Access Client for Windows 26.11.1.6 and later.
  • CVE-2026-118269 (CVSS 8.5): improper privilege management in Secure Access Client for Linux that can allow a low-privileged user to gain root. Fixed in Secure Access Client for Linux 26.10.4 and later.

Citrix’s review process and the company’s advisory

Citrix said the security updates follow a deeper review of its codebase after it integrated artificial intelligence–assisted code analysis. The vendor described that step as intended to detect and resolve vulnerabilities proactively “with an aim to harden the products before potential threats could materialize.”

In the advisory Citrix also stated it was not aware of any exploits for the announced vulnerabilities, and it urged customers to apply the updates because they are designed to “enhance the security posture of NetScaler.”

What this means for technologists, procurement leaders, and end users

  • Technologists and security teams: The patch set covers multiple components and configuration-dependent attack surfaces — from packet processing and SMPP to DNS-over-HTTPS, ICA proxy and Endpoint Analysis. Teams should verify whether their NetScaler instances use the specific features called out (SMPP virtual servers, DNS load balancing with recursive resolution, Email Action, PUSH, AAA/Gateway, VPN virtual servers) and prioritize upgrades to the listed fixed releases.
  • Procurement and compliance leaders: The vendor supplied separate fixed releases for standard, FIPS, and NDcPP builds (for example, 14.1-73.58 FIPS and 13.1-37.293 NDcPP/FIPS releases). Organizations that rely on those certified editions should track the corresponding patched releases rather than treating a single version string as sufficient.
  • End users and administrators of endpoints: The Secure Access Client fixes address local privilege-escalation flaws on Windows and Linux that can allow a low-privileged local account to gain SYSTEM or root, respectively. Where enterprises use those clients, administrators should deploy the stated Secure Access Client versions (Windows 26.11.1.6, Linux 26.10.4) to remove the documented escalation paths.

Citrix has published specific CVE identifiers, configuration conditions, and version numbers for remediation; it has also stated it knows of no active exploitation. For organizations that run NetScaler in any of the enumerated modes — gateway, AAA, VPN, DNS load balancing, SMPP, Email OTP, PUSH, or ICA proxy — the path from disclosure to mitigation is straightforward: verify configuration exposure and upgrade to the listed fixed releases.

Original report at The Hacker News

Authentication BypassCitrixEmerging ThreatsNetscalerDenial Of ServiceVulnerability PatchingSecure Access ClientCVE-2026-120868
Related Intelligence

Continue Reading

Server racks and storage units in a data center with a highlighted container registry appliance in the foreground.

Red Hat Quay Flaw Exposes Private Container Images to Attack

A critical flaw in Red Hat Quay, tracked as CVE-2026-123710, allows attackers to access and manipulate private container images, putting sensitive data and systems at risk. This severe vulnerability enables hackers to add a malicious key, granting them unlimited access to read, overwrite, and even inject malware into private images.

Analyst 207
Empty network operations center with rows of computer servers and management consoles in a brightly-lit room.

Compromised Endpoint Platforms Expose Enterprises to Hidden Risks

Endpoint management platforms, meant to secure thousands of devices, can ironically become a hacker’s dream come true if compromised, giving them free rein to wreak havoc on an enterprise. By offering a single, centralized system to deploy patches, install software, and enforce configurations, these platforms create a high-value target for attackers.

Analyst 207
Dimly lit server room with outdated hardware and a single, brightly lit Exchange Server setup.

Microsoft Warns of Permanently Vulnerable Exchange Servers

Microsoft just dropped a bombshell: if your organization is still using Exchange Server 2016 or 2019, consider them permanently vulnerable to attacks - and a immediate upgrade is strongly advised.

Analyst 207
Industrial setting with computer terminal and scattered network equipment.

PTC Fixes Flaw Enabling Remote Code Execution in Windchill, FlexPLM

PTC has patched a critical vulnerability in Windchill and FlexPLM that allowed hackers to execute remote code, giving them control over affected systems. The flaw, tracked as CVE-2026-126325, was caused by improper input validation and deserialization of untrusted data.

Analyst 207