Skip to main content
cve.nowby Sazabi
Menu
Early warnings

Early warning

Citrix patches critical NetScaler and Secure Access Client flaws, including authentication bypass

Citrix has released patches for 12 flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client, which The Hacker News reports can cause denial of service or authentication bypass.

SZB-14f7eea4a0Pending CVEConfirmed

Written by a model from the sources below. Verify against them.

Sources5Confirmed
Kind
Pending CVE
Vendor
Citrix
Product
NetScaler
Status
Confirmed
First seen
Confirmed

Summary

Citrix has released patches for 12 flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client, which The Hacker News reports can cause denial of service or authentication bypass. The item lists CVE-2026-120869, an improper authentication flaw in NetScaler Console that allows unauthenticated access to restricted resources.

What to do

  • Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or 13.1-64.39 or later

  • Upgrade NetScaler Console to 14.1-74.34 or later

  • Upgrade Secure Access Client for Windows to 26.11.1.6 or later and apply the Linux fix

  • Check NetScaler virtual server configurations against the affected types listed by Citrix

  • Review the CVE preconditions Citrix details for each flaw to judge exposure.

  • Prioritize the critical CVEs on internet-facing instances.

Timeline

  1. Made public by Mastodon
  2. First seen by cve.now
  3. Confirmed as CVE-2026-1208681 day
  4. Record last updated

Evidence 5

  1. Social
    Mastodon
    “Citrix NetScaler vulnerabilities fixed: CVE-2026-120868 hits default setups, CVE-2026-120869 bypasses Console login.”
  2. Social
    Mastodon
    “An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance”
    +19 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  3. Press
    The Hacker News
    “Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.”
  4. Social
    Mastodon
    “Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.”
    +9 more: Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon, Mastodon
  5. Press
    SecurityWeek
    “Citrix on Thursday announced patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical-severity bugs.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-14f7eea4a0

Has Citrix confirmed it?

Yes. Confirmed as CVE-2026-120868.Source: Mastodon, Mastodon, The Hacker News, Mastodon, SecurityWeek

What should Citrix and NetScaler users do?

Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or 13.1-64.39 or later. Upgrade NetScaler Console to 14.1-74.34 or later. Upgrade Secure Access Client for Windows to 26.11.1.6 or later and apply the Linux fix. Check NetScaler virtual server configurations against the affected types listed by Citrix. Review the CVE preconditions Citrix details for each flaw to judge exposure. Prioritize the critical CVEs on internet-facing instances.

Does it have a CVE?

Yes. It is tracked as CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111344, CVE-2026-120864, CVE-2026-120869, CVE-2026-118268, CVE-2026-118269, CVE-2026-111334 and CVE-2026-111338.Source: CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111344, CVE-2026-120864, CVE-2026-120869, CVE-2026-118268, CVE-2026-118269, CVE-2026-111334, CVE-2026-111338

Sources

Tracked as