Citrix words 27 of 28 NetScaler flaws as denial of service, yet its vectors rate 10 high on all three impacts
Citrix's 12 November 2026 bulletin for NetScaler ADC and Gateway says 27 of its 28 CVEs can lead to denial of service, yet the vector beside 10 of them rates confidentiality, integrity and availability all High. Neither it nor the Console bulletin says anything about exploitation.
By Parminder Kumar Sharma · LinkedIn · · 21 min read
27 of 28 are worded as denial of service; 10 vectors rate all three impacts High (derived)
Citrix's security bulletin CTX697305, published on 12 November 2026, lists 28 CVEs for NetScaler ADC and NetScaler Gateway. In 27 of the 28 entries Citrix's text says the flaw "can lead to unpredictable or erroneous behavior or Denial of Service", or a close variant of that wording; only CVE-2026-111348, a log file entry, does not (derived count). For 10 of those 27, the CVSS 4.0 vector printed beside the text rates the impact on the vulnerable system High for confidentiality, integrity and availability together (derived). Nine of the ten are the nine entries scored 9.0 or higher, and the other is CVE-2026-120866 at 7.7.
What that does not establish. Neither bulletin says that code execution is possible: the phrase "remote code execution" appears in neither, and neither does the word "exploit" (both checked in the saved pages). A High rating in a vector is the scorer's input about what a successful attack would cost, not a statement that anyone can do it. And the pages do not explain why the words say one thing and the vectors another. A second bulletin, CTX697320, adds a tenth Critical entry, CVE-2026-120869, an authentication bypass in NetScaler Console that Citrix scores 9.4; the CVE.org record for it prints a different attack vector and score. Both are below.
Cloud Software Group, whose affiliates include Citrix Systems, sells NetScaler, and it writes both the bulletins and the scores. The scores here are Citrix's own CVSS 4.0 scores; neither bulletin prints an NVD score.
What Citrix published on 12 November
Two bulletins, both marked Critical. CTX697305 covers customer-managed NetScaler ADC and NetScaler Gateway: 28 CVEs, each with a description, a pre-condition, a CWE and a CVSS 4.0 score and vector. CTX697320 covers NetScaler Console: one CVE, CVE-2026-120869, an authentication bypass. Citrix writes that Cloud Software Group "strongly urges" affected customers to install the updated versions "as soon as possible". The ADC and Gateway bulletin adds that "Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities", and that "Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates". The bulletin applies only to customer-managed products.
The 28 in numbers (derived). Nine score 9.0 or higher (one at 9.5, eight at 9.3), 14 score 8.7 or 8.3, and 5 score 7.7 or 6.9. Counted by the usual CVSS bands, that is 9 Critical, 15 High and 4 Medium. Twenty-seven are buffer or memory weakness classes (13 CWE-119, 6 CWE-122, 3 CWE-787, 3 CWE-120, one each of CWE-415 and CWE-121); the other is CWE-532, insertion of sensitive information into a log file. Twenty-three vectors are network, four are local and one is adjacent. Exactly one entry, CVE-2026-120868, names no feature: its pre-condition is "All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)". Each of the other 27 names a configuration, a role, a network position or local access.
Which builds. Citrix's fixed builds are the ones in the table. The September and October NetScaler fixes this site covered used older builds, so an appliance patched then is still before the new fixed build (derived from Citrix's own affected ranges and the earlier bulletins as recorded in the briefing on the CVE-2026-107406 bulletin). The pages print no release dates for any of these builds.
Affected and fixed builds for the ADC and Gateway bulletin CTX697305, and the fix builds for CVE-2026-107406 in the 8 October bulletin as recorded in this site's earlier briefing. Read 12 November 2026.
| Build line | Fixed in this bulletin | 8 October fix build |
|---|---|---|
| 14.1 ADC and Gateway | 14.1-73.57 and later | 14.1-73.46 |
| 13.1 ADC and Gateway | 13.1-64.39 and later of 13.1 | 13.1-64.29 |
| 14.1-FIPS ADC | 14.1-73.58 FIPS and later | 14.1-73.46 FIPS |
| 13.1-FIPS and 13.1-NDcPP ADC | 13.1-37.293 and later | 13.1.37.283 |
Secure Access Client bulletins, not read. The secondary source this briefing uses for comparison, a Daily CyberSecurity piece (page data dated 15:00 UTC on 12 November), reports that Citrix published four bulletins and that they fix 31 CVEs. That is 28 plus 1 plus 2 (derived): the two extra CVEs belong to bulletins for the Secure Access Client, which the secondary reports and this briefing did not read. No primary page for them was found, so this briefing does not describe them.
The words say denial of service; ten of the vectors say all three impacts are High
Every entry prints two statements about impact. The description says what the flaw can lead to. The vector, printed beside it, rates the impact on confidentiality (VC), integrity (VI) and availability (VA) of the vulnerable system as None, Low or High. If the two agreed, a flaw described as denial of service would show availability High and the other two None. Fifteen entries do exactly that. Thirteen do not.
How the 28 vectors rate the vulnerable system's confidentiality, integrity and availability (VC, VI, VA), against the text of each entry. Derived by this site from bulletin CTX697305, read 12 November 2026. All CVE numbers begin CVE-2026-.
| Vector pattern | Entries | Count |
|---|---|---|
| VC:N VI:N VA:H, availability only: the same shape as the words | 107411, 107413, 107414, 111340, 111341, 111342, 111343, 111345, 111347, 120860, 120861, 120862, 120863, 120865, 120867 | 15 |
| VC:H VI:H VA:H, all three High. Text says denial of service in every one | 120868, 107407, 107408, 107409, 107410, 107412, 107415, 111344, 120864, 120866 | 10 |
| VC:L VI:L VA:H. Text says denial of service | 111346 | 1 |
| VC:H VI:H VA:L, availability Low. Text says denial of service | 111349 | 1 |
| VC:H VI:H VA:L. Text is a log file entry, not denial of service | 111348 | 1 |
So 12 of the 27 entries worded as denial of service carry a vector that rates confidentiality or integrity above None (derived). FIRST's CVSS 4.0 specification defines High confidentiality as "a total loss of confidentiality, resulting in all information within the Vulnerable System being divulged to the attacker", with an alternative reading for a smaller disclosure that has a serious consequence. That is a definition of what the letter means; it does not say that anyone can reach that outcome, and neither does Citrix. What the bulletin does not do is say which reading of High it meant, or why a memory overflow worded as unpredictable behavior or denial of service gets it.
CVE-2026-111349 runs the other way. The text says denial of service, but the vector rates availability Low and confidentiality and integrity High, at 6.9, with a local attack vector. CVE-2026-120868, the entry that needs no feature, is rated 9.3 with all three High and Low subsequent system impact. CVE-2026-107412, the top score at 9.5, is one CVE for "Multiple Memory overflow vulnerabilities", with all six impact letters High, subsequent system included, and attack requirements present (AT:P).
A label standing in for a rating. "Denial of Service" is a comfortable label: it suggests a crash, a restart, an incident that ends. A queue that sorts by the label ranks these below anything described as code execution. That is the friendly name doing the work of a rating, and the vectors are the part of the page that does not support it for ten entries. The label is not new in this product line. In the September bulletin the same Citrix wrote, for the flaw CVE-2026-88772, "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service" beside a vector with all three impacts High, and Citrix said exploits of it had been observed. This site's briefing on a later flaw recorded a June title that said denial of service beside a vector with confidentiality High.
Citrix's wording and vector for the same impact shape in two bulletins. The September row is from bulletin CTX697096, the November row from CTX697305, both read 12 November 2026.
| Bulletin and CVE | Citrix's wording | Vector impact, score |
|---|---|---|
| 27 September, CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | VC:H VI:H VA:H, 9.5 |
| 12 November, CVE-2026-120868 | Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service | VC:H VI:H VA:H, 9.3 |
| 12 November, nine at 9.0 or higher | All nine say denial of service; none says remote code execution | VC:H VI:H VA:H in all nine |
Local and adjacent vectors. Four entries carry AV:L, local. FIRST defines it as "The vulnerable system is not bound to the network stack and the attacker's path is via read/write/execute capabilities". In this site's reading, two of the four sit oddly beside their own pre-conditions: CVE-2026-111343 is a "Memory overflow in an authentication request" on a Gateway or AAA virtual server, and CVE-2026-111345 is "Improper request handling" on an appliance "reachable as ADC/Gateway on the data path". The page does not say what local means for either. The fifth non-network vector is CVE-2026-120866, AV:A at 7.7, whose pre-condition says the attacker "must be, or be able to spoof, the configured neighbor", which fits an adjacent rating.
The identifiers do not all resolve yet: 21 had no CVE.org record and seven pointed at other products
The CVE Program's API is the public record of which CVE ID belongs to what. Between 17:40 and 17:42 UTC on 12 November 2026 this site asked it once for each of the 28 IDs in the ADC and Gateway bulletin. Twenty-one returned no record (CVE_RECORD_DNE, the record does not exist). Seven, CVE-2026-111343 to CVE-2026-111349, returned a published record assigned by VulnCheck on 15 October 2026 for a different vendor's product; none of the seven mentions NetScaler or Citrix (derived by searching each saved record). None returned a NetScaler record. NVD returned no result for CVE-2026-120868.
What the CVE Program API answered for the 28 ADC and Gateway IDs, 12 November 2026, 17:40 to 17:42 UTC, one request per ID.
| IDs in bulletin CTX697305 | CVE.org answer | Count |
|---|---|---|
| 107407 to 107415, 111340 to 111342, 120860 to 120868 | No record exists | 21 |
| 111343 to 111349 | A published VulnCheck record for another vendor's product, dated 15 October 2026 | 7 |
| CVE-2026-120869, the Console bypass (separate bulletin) | A published record by the NetScaler CNA at 14:03 UTC on 12 November | 1 |
What that does not establish. It does not say Citrix's IDs are wrong. A numbering authority's records can appear after its bulletin; the Console record appeared at 14:03 UTC, six minutes after its own public date of 13:57 UTC (derived), and the ADC and Gateway records had not appeared by 17:42. The two Citrix pages agree with each other: the documentation page lists the same 28 IDs with the release date 12 Nov 2026. But for seven of them CVE.org currently ties the number to something else, and the pages do not say why. A scanner, a ticket or a spreadsheet keyed on the ID alone could pull the wrong product's record for those seven, so key on the Citrix bulletin number as well until Citrix and CVE.org agree. Read at one time, once, and liable to change within the hour.
The Console bypass: adjacent on Citrix's page, network on the CVE.org record
CVE-2026-120869 is described as "An unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance". The pre-condition is "Access to Citrix NetScaler Console IP". It is CWE-287, Improper Authentication, and Citrix scores it 9.4. The fix is NetScaler Console 14.1-74.34 and later; the affected range is 14.1 before 14.1-74.34. The bulletin prints no workaround and no pre-condition beyond reaching the Console's IP address.
How three records score CVE-2026-120869, read 12 November 2026. The CVE.org and NVD records were read at 17:40 UTC.
| Record | Score and vector | Notes |
|---|---|---|
| Citrix bulletin CTX697320 | 9.4. AV:A, subsequent system SC:H SI:H SA:H | Adjacent network; the bulletin |
| CVE.org record, NetScaler CNA, published 14:03 UTC | 9.3. AV:N, subsequent system SC:L SI:L SA:L | Network; source.discovery UNKNOWN, no credits |
| NVD, status Received, published 14:17 (no zone stated) | 9.3. AV:N, the CNA's score marked Secondary | No NVD score, no CVSS 3.1 |
What AV:A means. In FIRST's specification an adjacent attack is one where "the attack is limited at the protocol level to a logically adjacent topology": the same shared network or a limited administrative domain, not routed across the internet. AV:N means the attacker can be anywhere that can reach the interface, "up to and including the entire Internet". Four letters differ between the bulletin vector and the record's (AV, SC, SI and SA; derived), and the two scores differ by 0.1. The pages do not say which is right. The secondary source follows the bulletin and says the vector marks the attack as adjacent network. This briefing keeps both.
What the page does say about the attacker. Unauthenticated, no user interaction, access to the Console's IP address. It does not say from which networks that address is reachable in a default deployment, whether Console sits behind NetScaler or beside it, or what "restricted resources" are. The NetScaler Console documentation page for Security Advisory, last published 12 November, lists the 28 ADC and Gateway IDs with the release date 12 Nov 2026, each marked "Requires version scan" with the remedy to upgrade to the recommended build; it does not list CVE-2026-120869.
Who found them: outside researchers, and an AI-assisted analysis that Citrix does not describe
The ADC and Gateway bulletin thanks outside researchers from two organisations, the JPMorgan Chase XOR team and watchTowr, "for working with us to protect our customers". It then adds that "the Cloud Software Group Product Security Team identified several vulnerabilities through advanced AI-assisted code analysis". The Console bulletin says the flaw was "Discovered by the Cloud Software Group Product Security Team using advanced AI-assisted analysis". Both are Citrix's own account of its own product. (This briefing names organisations, not the individuals the bulletin names.)
What that does not say. Neither page names a tool or a model. Neither says how many of the 28 "several" covers, which entries came from the outside researchers and which from the internal analysis, or whether the 28 share a cause. The JPMorgan Chase XOR team was also credited on the 27 September bulletin; the pages do not say whether any of this batch is related to those flaws, and the CVE.org record for the Console flaw gives its discovery field as UNKNOWN with no credits.
Exploitation: silent here, and earlier NetScaler cases went three different ways
Neither bulletin contains the word exploit, a workaround, a mitigation or a compromise indicator (all checked in the saved pages). The September bulletin, by contrast, says "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." "Not stated" is not "not exploited", and the pages do not say that Citrix has looked. The secondary source says "Citrix reports no exploitation" and labels each CVE in its table "Not exploited"; the primaries do not say that.
What each source says about exploitation of the 12 November CVEs, read 12 November 2026. The KEV file is CISA's copy, version 2026.11.10, released 19:03 UTC on 10 November.
| Source | What it says | What it does not say |
|---|---|---|
| Citrix bulletins CTX697305 and CTX697320 | Nothing about exploitation, a proof of concept, a workaround or compromise artifacts | Whether any CVE is exploited, or that none is |
| CISA catalogue 2026.11.10 | Lists none of the 29 IDs | Anything about 12 November: the file was released two days before the bulletins, so its silence is not a finding |
| NVD, CVE-2026-120869 | Status Received, the CNA's score only | An NVD score or an exploitation field |
| Daily CyberSecurity (secondary) | Citrix reports no exploitation; no public proof of concept confirmed | A source for either statement |
What earlier cases show. This site covered three earlier 2026 NetScaler bulletins (27 September, 3 October and 8 October), and they give no rule that a bulletin's silence settles. For CVE-2026-88771 and CVE-2026-88772 the bulletin of 27 September itself said exploits had been observed, CISA listed both the same day, and the earliest documented exploitation was 5 September, 22 days before the fix (22 days before the patch, the eight flaw bulletin). For CVE-2026-88779 Citrix's bulletin was silent, a Citrix blog said attacks had been observed, and CISA listed it on 4 October, a day after the docs page's 3 October release date (derived, third listing). For CVE-2026-107406 the 8 October blog said Citrix was not aware of unmitigated exploits, and the saved CISA file of 10 November does not list it (third bulletin in 11 days). That file holds six NetScaler entries added in 2026, the first on 30 March (derived). Exploitation evidence therefore arrived before the bulletin in one case, a day after it in another, and had not appeared in the catalogue after a month in a third.
One thing is absent here. In late September Citrix's page said, per this site's briefing on the web shell reports, that an update "does not remove potential compromise artifacts". Neither 12 November page says anything about compromise or cleanup.
Where the sources differ
Differences between Citrix's pages and records and the Daily CyberSecurity piece (page data dated 15:00 UTC, 12 November 2026), read 12 November 2026. None is resolved here.
| Topic | Citrix and CVE.org | Daily CyberSecurity |
|---|---|---|
| How many CVEs | 28 in CTX697305 plus 1 in CTX697320, 29 read | 31 across four bulletins; the two Secure Access Client bulletins, covering 2 CVEs, were not read |
| Exploitation | Not stated in either bulletin | Citrix reports no exploitation; each CVE in its table marked Not exploited |
| Workaround | No workaround section printed; none described as absent | The bulletins list no workaround, so upgrading is the only fix |
| Severity tally | Recount of the two bulletins read: 10 Critical (9 plus the Console), 15 High, 4 Medium among the 29 | 9 Critical, 16 High, 6 Medium across 31 |
| Console vector | Bulletin AV:A at 9.4; CVE.org and NVD AV:N at 9.3 | Adjacent network, following the bulletin |
| Impact wording | 27 say denial of service; 10 vectors all High | Ten flaws have high impact on all three; the bulletin describes only denial of service and does not claim code execution |
The secondary's count of ten High-on-all-three flaws agrees with the recount here, and its reading that the bulletin does not claim code execution agrees with the page. Its severity tally does not match the recount, and the difference cannot be settled without the bulletin this site did not read.
What to do, in order
Items 1 and 2 are Citrix's own instructions as the bulletins print them. Items 3 to 9 are this site's suggestions; none is Citrix's advice, and item 7 is a judgment about risk, not a finding.
Take this with you
Order of work
- Citrix: install the listed builds, ADC and Gateway 14.1-73.57, 13.1-64.39, 14.1-FIPS 14.1-73.58 FIPS, 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later, and NetScaler Console 14.1-74.34 and later, after reading the exact lines in the bulletins.
- Citrix: use its Steps to determine if a deployment meets the CVE preconditions in CTX697305. Twenty-five of the 28 entries have steps; CVE-2026-111345, CVE-2026-111348 and CVE-2026-120863 have none, so treat those by build.
- This site's suggestion: treat CVE-2026-120868 first and by build, not by feature. Citrix says all deployments are affected, including the default configuration, so a configuration review cannot clear an appliance that is below the fixed build.
- This site's suggestion: next, rank by pre-condition. Gateway and AAA virtual servers appear in five entries, including the top score, CVE-2026-107412 at 9.5. Then the authentication actions (SAML, WebAuth, Email OTP, LDAP, certificate), then protocol listeners such as SMPP, DNS over HTTPS, PUSH and QUIC.
- This site's suggestion: keep the NSIP and NSIP6 management addresses and the NetScaler Console IP off any network an untrusted device can reach. CVE-2026-120863 names reachability of the NSIP, and the Console flaw needs only access to the Console IP. Citrix's vector says adjacent and the CVE.org record says network, so assume network until Citrix says otherwise.
- This site's suggestion: if an appliance was patched in September or October, it is still before the new fixed build. Do not close the earlier ticket as covering this one.
- This site's suggestion, a judgment: schedule these on the timetable you would use for an exploited flaw, even though the pages do not say any is exploited. Earlier 2026 NetScaler cases covered on this site show exploitation evidence before a bulletin, a day after it, and not at all within a month; the silence of these pages tells you little either way.
- This site's suggestion: for CVE-2026-111343 to CVE-2026-111349, track the Citrix bulletin number as well as the CVE ID until CVE.org shows the NetScaler records.
- This site's suggestion: re-read both bulletins and the CISA catalogue before closing the work. Citrix can edit a page, CVE.org records can appear, and a listing can arrive after publication.
Technical details
Citrix's bulletins print identifiers, descriptions, pre-conditions, CWEs, scores, vectors, build numbers and, for 25 of the 28 entries, configuration patterns to check. They print no indicator of compromise, no detection rule, no exploit detail and no workaround. The blocks below are copied as written; only the layout is this site's, and the saved text has lost the pages' line breaks.
Fixed and affected builds. A defender compares each appliance's build with these lines. The Console build is separate from the ADC and Gateway builds.
NetScaler ADC and Gateway, bulletin CTX697305, What Customers Should Do:
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.57 and later releases
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.39 and later releases of 13.1
Citrix NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS and later releases of 14.1-FIPS
Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later releases of 13.1-FIPS and 13.1-NDcPP
NetScaler ADC and Gateway, bulletin CTX697305, Affected Versions:
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.57
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.39
Citrix NetScaler ADC FIPS BEFORE 14.1-73.58 FIPS
Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.293
NetScaler Console, bulletin CTX697320, What Customers Should Do:
Citrix NetScaler Console 14.1-74.34 and later releases
NetScaler Console, bulletin CTX697320, Affected Versions:
Citrix NetScaler Console 14.1 BEFORE 14.1-74.34
The vector letters. This is the first vector in the bulletin and the key to the letters this briefing relies on. The key is derived from the FIRST CVSS 4.0 specification and is this site's reading, not Citrix's.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L <- CVE-2026-120868, as Citrix prints it
Segments this briefing relies on (the reading is this site's, from the FIRST CVSS 4.0 specification):
AV:N attack vector network. AV:A adjacent. AV:L local.
VC, VI, VA impact on confidentiality, integrity, availability of the vulnerable system. N none, L low, H high.
SC, SI, SA the same three for any subsequent system.
AT:P attack requirements present. PR:N no privileges. UI:N no user interaction.
All 28 entries, as printed. Three blocks by score band. Each entry shows the identifier, the description, the pre-condition, the CWE and the score with its vector. A defender can paste a vector into a CVSS 4.0 calculator to see the sub scores.
CVE-2026-120868
Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service.
All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-107407
Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC is configured with a Load Balancing (LB) or Content Switching (CS) virtual server of type SMPP.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-107408
Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC is configured for DNS load balancing and recursive DNS resolution.
CWE-787: Out-of-bounds Write
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-107409
Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service
NetScaler is configured with DNS Load Balancing over HTTPS (DOH).
CWE-415: Double Free
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVE-2026-107410
Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler is configured as Load Balancing (LB) virtual server of type PUSH
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-107412
Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service
NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
CVE-2026-107415
Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC or NetScaler Gateway is configured with an Email Action.
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-111344
Memory overflow in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or a Denial of Service
The NetScaler appliance is configured as a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis (EPA).
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120864
Memory overflow in ICA proxy can lead to unpredictable or erroneous behavior or Denial of Service.
The appliance must be configured as a Gateway vpn virtual server or an AAA virtual server or CR virtual server of type HDX
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
CVE-2026-107411
Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC is configured with a Load Balancing (LB) virtual server of type RTSP or have RTSP ALG enabled on an LSN group.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-107413
Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC or NetScaler Gateway is configured with a SAML action
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-107414
Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC or NetScaler Gateway is configured with a WebAuth action.
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-111340
Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC or NetScaler Gateway is configured as either an LDAP action with KBAttribute or an Email action.
CWE-121: Stack-based Buffer Overflow
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-111341
Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC or NetScaler Gateway must be configured with a certificate authentication action (CertAction)
CWE-120: Buffer Copy without Checking Size of Input
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-111342
Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
CWE-120: Buffer Copy without Checking Size of Input
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-111346
Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service
Any HTTP/SSL type virtual server with HTTP/2 enabled in the associated HTTP profile
CWE-787: Out-of-bounds Write
CVSS v4.0 Base Score: 8.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L)
CVE-2026-111347
Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service
A policy containing the B64DECODE operator must be bound globally or to a virtual server of any type, and/or an Application Firewall (AppFW) must be configured
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120860
Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler ADC must be configured as a Load Balancing (LB) virtual server of type DIAMETER, SIP_TCP, MQTT, or RADIUS.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120861
Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service.
The NetScaler appliance must have any of the following configured: a GSLB site with Metric Exchange Protocol (MEP) enabled, GSLB static proximity, a geolocation responder policy, or GSLB automatic configuration synchronization.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120862
Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service.
The NetScaler appliance must have SIP ALG enabled on an LSN group OR DNS answer-section security logging enabled in a DNS profile.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120863
Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service
An attacker on an untrusted host must be able to reach the NetScaler appliance’s NSIP or NSIP6 address.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)
CVE-2026-120865
Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service.
The NetScaler appliance must be configured as a Load Balancing (LB) or Content Switching (CS) virtual server of type HTTP_QUIC
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-120867
Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service.
The NetScaler appliance must be configured with TLS 1.3 vserver with ECH profile configured Or TLS 1.3 vserver on Intel QAT (Coleto) Platforms with ECH profile configured Or SSL vserver with SafeNet HSM Key bound
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-111343
Memory overflow in an authentication request can lead to unpredictable or erroneous behavior or Denial of Service.
NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
CWE-120: Buffer Copy without Checking Size of Input
CVSS v4.0 Base Score: 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:L)
CVE-2026-111345
Improper request handling can lead to a denial-of-service / reboot-loop condition
Appliance reachable as ADC/Gateway on the data path
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS v4.0 Base Score: 6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L)
CVE-2026-111348
Sensitive authentication material written to a log file
Local read access to /var/log/httperror.log on an appliance where any logout had occurred
CWE-532: Insertion of Sensitive Information into Log File
CVSS v4.0 Base Score:6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L)
CVE-2026-111349
Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service.
AppFW profile with affected protections (XML protection, multipart form-data, content-type inference, request-body signature or API Security/gRPC/OpenAPI spec)
CWE-122: Heap-based Buffer Overflow
CVSS v4.0 Base Score:6.9 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L)
CVE-2026-120866
Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service.
BGP dynamic routing must be enabled with a configured neighbor and without TCP-MD5 authentication for that neighbor. The attacker must be, or be able to spoof, the configured neighbor.
CWE-787: Out-of-bounds Write
CVSS v4.0 Base Score: 7.7 (CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
Configuration patterns to check pre-conditions. Citrix prints strings to search for in a saved configuration. A defender searches the saved ns.conf or the running configuration for them to learn whether an appliance meets a pre-condition. Five examples follow: the all deployments entry (which has text, not a pattern), a virtual server type, the Gateway and AAA entry, a SAML action, and the BGP entry, which uses two commands.
CVE-2026-120868 Precondition : All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
Instructions : All NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration. No additional features or settings need to be enabled for the NetScaler deployment to be vulnerable.
CVE-2026-107407 Precondition : NetScaler ADC is configured with a Load Balancing (LB) or Content Switching (CS) virtual server of type SMPP.
Instructions : Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following patterns: add lb vserver .* SMPP add cs vserver .* SMPP
CVE-2026-107412 Precondition : NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
Instructions : Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following: Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy): add vpn vserver .* AAA virtual server: add authentication vserver .*
CVE-2026-107413 Precondition : NetScaler ADC or NetScaler Gateway is configured with a SAML action
Instructions : Instructions: Customers can determine whether their NetScaler deployment is configured as a SAML service provider (SP) by checking its configuration for entries matching the following: add authentication samlAction
CVE-2026-120866 Precondition : BGP dynamic routing must be enabled with a configured neighbor and without TCP-MD5 authentication for that neighbor. The attacker must be, or be able to spoof, the configured neighbor.
Instructions : Check whether BGP is enabled and has a neighbor configured: 1. show ns feature -> BGP is ON 2. show router dynamicRouting -> output contains 'router bgp <ASN>' with at least one 'neighbor <IP> remote-as <ASN>' If BGP is OFF or no neighbor is configured, the appliance is not vulnerable.
A spelling to watch. For CVE-2026-107409 the page prints the option as dnsoOverHttps, with an extra letter o, while the entry for CVE-2026-107408 and the second line of the same entry print dnsOverHttps. A search for the first spelling would match no appliance. This is how the page prints it; this site does not know which is intended.
CVE-2026-107408, as printed:
add lb vserver <name> SSL <ip> <port> -dnsOverHttps ENABLED
CVE-2026-107409, as printed:
add lb vserver <name> SSL <ip> <port> -dnsoOverHttps ENABLED
add cs vserver <name> SSL <ip> <port> -dnsOverHttps ENABLED
Two entries without a pattern to run. CVE-2026-111347 says to search the configuration for the B64DECODE operator, and CVE-2026-111348 names a log file that holds sensitive authentication material. A defender checks who can read that file.
CVE-2026-111347, as printed (Instructions):
Check for any policy expression with B64DECODE bound to any vserver
Example: HTTP.REQ.BODY(10000).B64DECODE
grep only for B64DECODE in the ns.conf, and if found, NetScaler is vulnerable
CVE-2026-111348, as printed (Pre-conditions):
Local read access to /var/log/httperror.log on an appliance where any logout had occurred
The Console record. These are the CVE.org record's fields for CVE-2026-120869, with Citrix's bulletin score beneath for comparison. A defender uses the version range and compares the two vectors.
cveMetadata.cveId: CVE-2026-120869
cveMetadata.assignerShortName: NetScaler
cveMetadata.state: PUBLISHED
cveMetadata.dateReserved: 2026-11-03T00:53:55.696Z
cveMetadata.datePublished: 2026-11-12T14:03:14.594Z
cna.datePublic: 2026-11-12T13:57:00.000Z
cna.title: An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
cna.affected: Citrix NetScaler Console, version 0, lessThan 14.1-74.34
cna.metrics.cvssV4_0.vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
cna.metrics.cvssV4_0.baseScore: 9.3
cna.source.discovery: UNKNOWN
cna.references: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320
Citrix bulletin CTX697320, for comparison:
CVSS v4.0 Base Score: 9.4 (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
The identifier lookups. What the CVE Program API returned for the 28 ADC and Gateway IDs. A defender who matches scanner output by CVE ID can use this to see which IDs map to other products.
Request: GET cveawg.mitre.org/api/cve/<ID>, one request per ID, read 12 November 2026 between 17:40 and 17:42 UTC
Answer for 21 of the 28 IDs:
{"error":"CVE_RECORD_DNE","message":"The cve record for the cve id does not exist."}
The 21 IDs: CVE-2026-107407 to CVE-2026-107415, CVE-2026-111340 to CVE-2026-111342, CVE-2026-120860 to CVE-2026-120868
Answer for the other 7 IDs (state, assignerShortName, datePublished as the record prints them):
CVE-2026-111343 PUBLISHED VulnCheck 2026-10-15T21:43:35.878Z
CVE-2026-111344 PUBLISHED VulnCheck 2026-10-15T21:43:36.608Z
CVE-2026-111345 PUBLISHED VulnCheck 2026-10-15T21:43:37.267Z
CVE-2026-111346 PUBLISHED VulnCheck 2026-10-15T21:43:37.962Z
CVE-2026-111347 PUBLISHED VulnCheck 2026-10-15T21:43:38.664Z
CVE-2026-111348 PUBLISHED VulnCheck 2026-10-15T21:43:39.350Z
CVE-2026-111349 PUBLISHED VulnCheck 2026-10-15T21:43:40.064Z
NVD, GET services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120868, read 17:40 UTC: totalResults 0
The question the pages leave open
For ten entries Citrix's text says denial of service and Citrix's vector says all three impacts are High, and no page says which should set a patch window. Which of the two is Citrix standing behind, and why has it not said?
Key facts
Sources
- PrimarySecurity bulletin CTX697305, NetScaler ADC and NetScaler Gateway: 28 CVEs with descriptions, pre-conditions, CWEs, CVSS 4.0 scores and vectors, fixed builds, configuration checks, acknowledgement. Saved by the lead on 12 November 2026Citrix (Cloud Software Group)accessed 2026-11-12
- PrimarySecurity bulletin CTX697320, NetScaler Console: CVE-2026-120869, CVSS 4.0 9.4, fixed in 14.1-74.34. Saved by the lead on 12 November 2026Citrix (Cloud Software Group)accessed 2026-11-12
- PrimarySecurity bulletin CTX697096 of 27 September 2026, used for contrast: its wording and vectors for CVE-2026-88771 and CVE-2026-88772 and its statement that exploits were observedCitrix (Cloud Software Group)accessed 2026-11-12
- PrimarySupported CVEs through Security Advisory (NetScaler Console), last published 12 November 2026: the 28 IDs with release date 12 Nov 2026 and the earlier release datesNetScaler documentationaccessed 2026-11-12
- PrimaryCVE record for CVE-2026-120869, published by the NetScaler CNA at 14:03 UTC on 12 November 2026: description, vector AV:N, score 9.3, discovery UNKNOWNCVE Program (CVE.org)accessed 2026-11-12
- PrimaryNVD record for CVE-2026-120869 at 17:40 UTC on 12 November 2026: status Received, the CNA's score as SecondaryNIST National Vulnerability Databaseaccessed 2026-11-12
- PrimaryKnown Exploited Vulnerabilities catalogue version 2026.11.10 (released 19:03 UTC on 10 November): none of the 29 IDs listed; six NetScaler entries added in 2026CISAaccessed 2026-11-12
- PrimaryCVSS v4.0 specification document: definitions of Attack Vector (network, adjacent, local), the impact metrics and the qualitative severity bandsFIRSTaccessed 2026-11-12
- Reported bySecondary, page data dated 15:00 UTC on 12 November 2026: reports four bulletins and 31 CVEs; used for comparison only, never as the source of a figureDaily CyberSecurity (securityonline.info)accessed 2026-11-12
