# SZB-14f7eea4a0: Citrix patches critical NetScaler and Secure Access Client flaws, including authentication bypass

Citrix has released patches for 12 flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client, which The Hacker News reports can cause denial of service or authentication bypass.

- Type: Early warning
- Kind: Pending CVE
- Vendor: Citrix
- Product: NetScaler
- Status: Confirmed
- Sources: 5 distinct
- First seen: 2026-11-12 15:02 UTC
- Confirmed: 2026-11-12 16:10 UTC

Written by a model from the sources below. Verify against them.

## Summary

Citrix has released patches for 12 flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client, which The Hacker News reports can cause denial of service or authentication bypass. The item lists CVE-2026-120869, an improper authentication flaw in NetScaler Console that allows unauthenticated access to restricted resources.

## What to do

- Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or 13.1-64.39 or later
- Upgrade NetScaler Console to 14.1-74.34 or later
- Upgrade Secure Access Client for Windows to 26.11.1.6 or later and apply the Linux fix
- Check NetScaler virtual server configurations against the affected types listed by Citrix
- Review the CVE preconditions Citrix details for each flaw to judge exposure.
- Prioritize the critical CVEs on internet-facing instances.

## Timeline

- 2026-11-12 15:01 UTC: Made public by Mastodon
- 2026-11-12 15:02 UTC: First seen by cve.now
- 2026-11-12 16:10 UTC: Confirmed as CVE-2026-120868
- 2026-11-13 09:40 UTC: Record last updated

## Evidence (5 sources)

- 2026-11-12 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117604070260722114): “Citrix NetScaler vulnerabilities fixed: CVE-2026-120868 hits default setups, CVE-2026-120869 bypasses Console login.”
- 2026-11-12 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117604087849997076): “An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance” (+19 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117607131222792570), [Mastodon](https://mastodon.social/@EUVD_Bot/117607131251413517), [Mastodon](https://mastodon.social/@EUVD_Bot/117607131278629461), [Mastodon](https://mastodon.social/@EUVD_Bot/117607131316437829), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078819731785), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078849004318), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078875099141), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078901263804), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078928366184), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078957361842), [Mastodon](https://mastodon.social/@EUVD_Bot/117608078984565350), [Mastodon](https://mastodon.social/@EUVD_Bot/117608314929572461), [Mastodon](https://mastodon.social/@EUVD_Bot/117608314958332081), [Mastodon](https://mastodon.social/@EUVD_Bot/117608315020616930), [Mastodon](https://mastodon.social/@EUVD_Bot/117608315055671122), [Mastodon](https://mastodon.social/@EUVD_Bot/117608318658634263), [Mastodon](https://mastodon.social/@EUVD_Bot/117608318735145124), [Mastodon](https://mastodon.social/@EUVD_Bot/117608318795875723), [Mastodon](https://mastodon.social/@EUVD_Bot/117608318825449889))
- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html): “Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.”
- 2026-11-13 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117606191425181393): “Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.” (+9 more: [Mastodon](https://infosec.exchange/@suriq/117606787725110457), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899170423643), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899211573442), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899268403243), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899293827355), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899320305740), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899347951944), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899372763530), [Mastodon](https://mastodon.social/@EUVD_Bot/117606899397668899))
- 2026-11-13 · Press · [SecurityWeek](https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/): “Citrix on Thursday announced patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical-severity bugs.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-14f7eea4a0&body=https%3A%2F%2Fcve.now%2FSZB-14f7eea4a0%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-14f7eea4a0

### Has Citrix confirmed it?

Yes. Confirmed as CVE-2026-120868.

Source: https://infosec.exchange/@DailyCyberSecurity/117604070260722114, https://mastodon.social/@EUVD_Bot/117604087849997076, https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html, https://mastodon.social/@EUVD_Bot/117606191425181393, https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/

### What should Citrix and NetScaler users do?

Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.57 or 13.1-64.39 or later. Upgrade NetScaler Console to 14.1-74.34 or later. Upgrade Secure Access Client for Windows to 26.11.1.6 or later and apply the Linux fix. Check NetScaler virtual server configurations against the affected types listed by Citrix. Review the CVE preconditions Citrix details for each flaw to judge exposure. Prioritize the critical CVEs on internet-facing instances.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111344, CVE-2026-120864, CVE-2026-120869, CVE-2026-118268, CVE-2026-118269, CVE-2026-111334 and CVE-2026-111338.

Source: https://cve.now/CVE-2026-120868, https://cve.now/CVE-2026-107407, https://cve.now/CVE-2026-107408, https://cve.now/CVE-2026-107409, https://cve.now/CVE-2026-107410, https://cve.now/CVE-2026-107412, https://cve.now/CVE-2026-107415, https://cve.now/CVE-2026-111344, https://cve.now/CVE-2026-120864, https://cve.now/CVE-2026-120869, https://cve.now/CVE-2026-118268, https://cve.now/CVE-2026-118269, https://cve.now/CVE-2026-111334, https://cve.now/CVE-2026-111338

## Tracked as

- [CVE-2026-120868](https://cve.now/CVE-2026-120868.md)
- [CVE-2026-107407](https://cve.now/CVE-2026-107407.md)
- [CVE-2026-107408](https://cve.now/CVE-2026-107408.md)
- [CVE-2026-107409](https://cve.now/CVE-2026-107409.md)
- [CVE-2026-107410](https://cve.now/CVE-2026-107410.md)
- [CVE-2026-107412](https://cve.now/CVE-2026-107412.md)
- [CVE-2026-107415](https://cve.now/CVE-2026-107415.md)
- [CVE-2026-111344](https://cve.now/CVE-2026-111344.md)
- [CVE-2026-120864](https://cve.now/CVE-2026-120864.md)
- [CVE-2026-120869](https://cve.now/CVE-2026-120869.md)
- [CVE-2026-118268](https://cve.now/CVE-2026-118268.md)
- [CVE-2026-118269](https://cve.now/CVE-2026-118269.md)
- [CVE-2026-111334](https://cve.now/CVE-2026-111334.md)
- [CVE-2026-111338](https://cve.now/CVE-2026-111338.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-14f7eea4a0
Site guide for agents: https://cve.now/llms.txt