Citrix NetScaler: 28 Memory Flaws Put Exposure Management to the Test

A network gateway can sit quietly at the edge of an organisation's infrastructure for years. It handles remote access, application delivery and traffic between users and internal systems. That makes its security status a business concern, particularly when a vulnerability affects a default deployment.

On 12 November 2026, Citrix published security bulletins addressing vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway products. The European Union's cybersecurity service, CERT-EU, reported that the release covers 28 memory-related flaws. One of the broadest, CVE-2026-120868, affects every NetScaler ADC and Gateway deployment, including default configurations. It has a CVSS v4.0 score of 9.3 and involves a memory overflow in core packet processing. No additional feature needs to be enabled and no authentication is required for the vulnerable condition. 【1】【2】

The vendor describes the potential impact as unpredictable or erroneous behaviour and denial of service. That distinction matters: the advisory does not describe this vulnerability as confirmed remote code execution. Another issue, CVE-2026-107412, carries a CVSS v4.0 score of 9.5 and affects specific Gateway and AAA configurations, including SSL VPN, ICA Proxy, CVPN and RDP Proxy deployments. 【1】【2】

There is also an important qualification. As of the 12 November advisory, CERT-EU reported no confirmed exploitation and no public proof-of-concept. Citrix said it was not aware of unmitigated exploits for the announced vulnerabilities. That does not remove the need to act. It gives security teams an opportunity to patch before attackers have a confirmed public exploit to work with. 【1】【3】

The affected software branches include NetScaler ADC and Gateway 14.1 versions earlier than 14.1-73.57 and 13.1 versions earlier than 13.1-64.39. The bulletin also lists separate fixed builds for FIPS and NDcPP editions. Organisations should match their exact edition and version against Citrix's bulletin rather than assume that every deployment follows the same upgrade path. 【1】【2】

CERT-EU recommends prioritising internet-facing Gateway and AAA appliances. That is a useful starting point, but the quality of the response depends on the asset information behind it.

A practical response should cover five checks:

• Find every appliance. Include production, standby, disaster recovery and less visible environments. Record the owner, software branch and installed build.

• Confirm its role and exposure. Identify Gateway, AAA and ADC functions, then establish which management and service interfaces are reachable from outside.

• Match the exact advisory conditions. CVE-2026-120868 affects default deployments, so the absence of optional features does not make an appliance safe from that flaw.

• Upgrade to the applicable fixed release. Follow Citrix's instructions and plan for service interruption. Citrix notes that existing ICA sessions terminate after an upgrade and need to be initiated again. 【2】【3】

• Verify the result. Confirm the installed build, test remote access and application delivery, review relevant logs and document the remediation evidence.

This work requires people who can read a technical advisory, understand the organisation's infrastructure and translate the findings into an operational priority. A high CVSS score helps establish severity, but teams still need to understand asset exposure, business dependency and the consequences of an outage.

Authorised security testing can provide another view of an organisation's supported digital environment. Bronyx AI, ITSEC's AI-assisted autonomous penetration testing platform, supports authorised assessment of supported external applications and attack surfaces. It can help organisations examine exposure in those environments, alongside vendor patching and infrastructure-specific checks. This should not be taken as a claim that Bronyx directly tests Citrix NetScaler appliances.

Review your organisation's supported external digital assets and identify weaknesses that warrant attention with Bronyx AI: https://bronyx.ai/

References

1. CERT-EU, “Security Advisory 2026-020: Critical Vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway,” 12 November 2026. https://cert.europa.eu/publications/security-advisories/2026-020/

2. Citrix, “Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin,” 12 November 2026. https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html

3. Citrix / NetScaler Cyber Threat Intelligence, “Security updates for NetScaler ADC, NetScaler Gateway, and NetScaler Console,” 12 November 2026. https://community.citrix.com/techzone-blogs/110_security-updates/security-updates-for-netscaler-adc-netscaler-gateway-and-netscaler-console/