Citrix Patches 28 NetScaler Flaws, Including Critical Console Bug

Summary

Citrix patched 28 NetScaler ADC and Gateway vulnerabilities, including nine critical flaws, and a critical NetScaler Console access-control bypass. The article does not mention in-the-wild exploitation.

Key points

• The NetScaler ADC and Gateway fixes address 28 vulnerabilities, including nine critical memory-overflow flaws that could cause erroneous behavior or denial of service.
• A medium-severity flaw, CVE-2026-111338, can expose sensitive authentication material in a log file.
• Citrix also patched CVE-2026-120869 in NetScaler Console, a critical unauthenticated access-control bypass with a CVSS score of 9.4.
• The Console flaw affects releases before version 14.1-74.34; the article lists patched ADC and Gateway versions and urges customers to update.
• Citrix does not mention any of the vulnerabilities being exploited in the wild.

CVE

Vendors

Products

Related Articles

• Citrix Patches NetScaler Flaws That Could Enable DoS and Authentication Bypassthehackernews.comNetScaler ADC · NetScaler Console · Citrix
• VulnCheck Finds 42.5% of Exploited Edge Vulnerabilities Affect End-of-Life Devicesgithub.com/jacobdjwilsonNetScaler ADC · NetScaler Gateway · Citrix
• Health-ISAC 2026 Report Highlights Ransomware and Supply Chain Risks in Healthcaregithub.com/jacobdjwilsonNetScaler ADC · NetScaler Gateway · Citrix
• Attackers Exploit Critical NetScaler Flaw for Unauthenticated Code Executionzscaler.comNetScaler ADC · NetScaler Gateway · Citrix
• eSentire Says It Traced Citrix NetScaler Exploitation to Weeks Before Disclosureesentire.comNetScaler ADC · Citrix