Citrix announced fixes on Thursday for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical-severity flaws in the two products. A separate critical issue affects NetScaler Console, bringing the total number of critical vulnerabilities addressed across the two advisories to ten.
The nine critical ADC and Gateway flaws are caused by memory overflow problems in Packet Processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP authentication, Endpoint Analysis (EPA/EPAS), and ICA proxy. Citrix says they could produce unpredictable or erroneous behavior or denial-of-service conditions. They are tracked as CVE-2026-120868, CVE-2026-107407 through CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334 and CVE-2026-120864.
Most of the remaining 19 ADC and Gateway defects are high-severity weaknesses that can lead to similar outcomes. Among the medium-severity bugs is CVE-2026-111338, which can expose sensitive authentication material in a log file.
Fixed versions
Patches are included in NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later. Citrix is urging customers to update affected instances promptly and has detailed preconditions for some of the CVEs.
NetScaler Console flaw
The Console vulnerability, CVE-2026-120869, carries a CVSS score of 9.4. It could let unauthenticated attackers bypass controls and reach restricted resources. Every NetScaler Console 14.1 release before 14.1-74.34 is affected.
Citrix did not state that any of the vulnerabilities have been exploited in the wild. NetScaler flaws are nonetheless a frequent target for threat actors.