{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2026-020.pdf"
    },
    "title": "Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway",
    "serial_number": "2026-020",
    "publish_date": "12-11-2026 17:20:53",
    "description": "On 12 November 2026, the Cloud Software Group published security bulletins for its Citrix products addressing 28 memory flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of these vulnerabilities, CVE-2026-120868, affects every deployment, including those using the default configuration. The vendor bulletin describes the impact as unpredictable behaviour and denial of service.<br>\nCitrix reports no exploitation, and no public proof-of-concept has been confirmed. CERT-EU strongly recommends upgrading all customer-managed NetScaler ADC and NetScaler Gateway appliances to the fixed releases. Internet-facing Gateway and AAA appliances should be upgraded first.<br>\n",
    "url_title": "2026-020",
    "content_markdown": "---\ntitle: 'Critical Vulnerabilities in\u00a0Citrix\u00a0NetScaler\u00a0ADC and\u00a0NetScaler\u00a0Gateway'\nnumber: '2026-020'\nversion: '1.0'\noriginal_date: '2026-11-12'\ndate: '2026-11-12'\n---\n\n_History:_\n\n* _12/11/2026 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn 12 November 2026, the Cloud Software Group published security bulletins for its **Citrix** products addressing 28 memory flaws in **Citrix NetScaler ADC** and **Citrix NetScaler Gateway** [1, 2]. One of these vulnerabilities, **CVE-2026-120868**, affects every deployment, including those using the default configuration [2]. The vendor bulletin describes the impact as unpredictable behaviour and denial of service [2].\n\nCitrix reports no exploitation, and no public proof-of-concept has been confirmed [1]. CERT-EU strongly recommends upgrading all customer-managed NetScaler ADC and NetScaler Gateway appliances to the fixed releases. Internet-facing Gateway and AAA appliances should be upgraded first.\n\n# Technical Details\n\nThe vulnerability **CVE-2026-120868**, with a CVSS score of 9.3, is a memory overflow vulnerability in core packet processing that does not require any special feature or authentication. The NetScaler ADC and Gateway bulletin states that all deployments are affected, including those with the default configuration [2].\n\nThe vulnerability **CVE-2026-107412**, with a CVSS score of 9.5, covers several memory overflow vulnerabilities that affect appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server. According to the vendor, these issues can be reached without authentication [2].\n\nThe remaining vulnerabilities depend on specific features, including SAML, WebAuth, LDAP, Email OTP and client-certificate authentication. Others affect DNS-over-HTTPS, HTTP/2, HTTP/3 (QUIC), SMPP, RTSP, BGP routing and the Application Firewall. Ten of the flaws are scored as having a high impact on confidentiality, integrity and availability. However, the vendor bulletin describes their impact only as unpredictable behaviour or denial of service [2].\n\n# Affected Products\n\nThe following versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected:\n\n* 14.1 before 14.1-73.57\n* 13.1 before 13.1-64.39\n* NetScaler ADC FIPS before 14.1-73.58 FIPS\n* NetScaler ADC FIPS and NDcPP before 13.1-37.293\n\nAdditional information is available in the vendor's advisory [2].\n\n# Recommendations\n\nCERT-EU strongly recommends upgrading all affected appliances to the fixed releases prioritising internet-facing Gateway and AAA appliances.\n\n# References\n\n[1] <https://community.citrix.com/techzone-blogs/110_security-updates/security-updates-for-netscaler-adc-netscaler-gateway-and-netscaler-console/>\n\n[2] <https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>12/11/2026 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On 12 November 2026, the Cloud Software Group published security bulletins for its <strong>Citrix</strong> products addressing 28 memory flaws in <strong>Citrix NetScaler ADC</strong> and <strong>Citrix NetScaler Gateway</strong> [1, 2]. One of these vulnerabilities, <strong>CVE-2026-120868</strong>, affects every deployment, including those using the default configuration [2]. The vendor bulletin describes the impact as unpredictable behaviour and denial of service [2].</p><p>Citrix reports no exploitation, and no public proof-of-concept has been confirmed [1]. CERT-EU strongly recommends upgrading all customer-managed NetScaler ADC and NetScaler Gateway appliances to the fixed releases. Internet-facing Gateway and AAA appliances should be upgraded first.</p><h2 id=\"technical-details\">Technical Details</h2><p>The vulnerability <strong>CVE-2026-120868</strong>, with a CVSS score of 9.3, is a memory overflow vulnerability in core packet processing that does not require any special feature or authentication. The NetScaler ADC and Gateway bulletin states that all deployments are affected, including those with the default configuration [2].</p><p>The vulnerability <strong>CVE-2026-107412</strong>, with a CVSS score of 9.5, covers several memory overflow vulnerabilities that affect appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server. According to the vendor, these issues can be reached without authentication [2].</p><p>The remaining vulnerabilities depend on specific features, including SAML, WebAuth, LDAP, Email OTP and client-certificate authentication. Others affect DNS-over-HTTPS, HTTP/2, HTTP/3 (QUIC), SMPP, RTSP, BGP routing and the Application Firewall. Ten of the flaws are scored as having a high impact on confidentiality, integrity and availability. However, the vendor bulletin describes their impact only as unpredictable behaviour or denial of service [2].</p><h2 id=\"affected-products\">Affected Products</h2><p>The following versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected:</p><ul><li>14.1 before 14.1-73.57</li><li>13.1 before 13.1-64.39</li><li>NetScaler ADC FIPS before 14.1-73.58 FIPS</li><li>NetScaler ADC FIPS and NDcPP before 13.1-37.293</li></ul><p>Additional information is available in the vendor's advisory [2].</p><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU strongly recommends upgrading all affected appliances to the fixed releases prioritising internet-facing Gateway and AAA appliances.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://community.citrix.com/techzone-blogs/110_security-updates/security-updates-for-netscaler-adc-netscaler-gateway-and-netscaler-console/\">https://community.citrix.com/techzone-blogs/110_security-updates/security-updates-for-netscaler-adc-netscaler-gateway-and-netscaler-console/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305\">https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}