Ethical Hacking News

Citrix Patches Critical Flaws in NetScaler, Secure Access Client, and Other Products, Urges Customers to Apply Updates

Citrix has issued patches for multiple critical security flaws in its NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console products, as well as its Secure Access Client for Windows and Linux.

The patches address vulnerabilities with a total CVSS score of 9.3, including memory overflow and memory corruption vulnerabilities.

Citrix has not announced any known exploits for the vulnerabilities, but urges customers to apply the updates to enhance the security posture of NetScaler.

The security updates were made possible by the integration of AI-assisted code analysis into Citrix's codebase review process.

Citrix has issued patches for multiple critical security flaws impacting its NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console products, as well as its Secure Access Client for Windows and Linux. The patches were released in response to a comprehensive review of the company's codebase, which utilized artificial intelligence (AI)-assisted code analysis to detect and resolve vulnerabilities.

According to the security updates, the critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below:

* CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet Processing can lead to unpredictable or erroneous behavior or denial-of-service (DoS) attacks. This vulnerability affects all NetScaler ADC and NetScaler Gateway deployments.
* CVE-2026-107407 (CVSS score: 9.3) - A memory overflow vulnerability in SMPP traffic can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler ADC configured with a Load Balancing or Content Switching virtual server of type SMPP.
* CVE-2026-107408 (CVSS score: 9.3) - A memory corruption vulnerability in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler ADC configured for DNS load balancing and recursive DNS resolution.
* CVE-2026-107409 (CVSS score: 9.3) - A memory corruption vulnerability in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler configured with DNS Load Balancing over HTTPS.
* CVE-2026-107410 (CVSS score: 9.3) - A memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler configured as Load Balancing virtual server of type PUSH.
* CVE-2026-107412 (CVSS score: 9.5) - Multiple memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and DoS attacks. This vulnerability affects NetScaler configured as a Gateway or an AAA virtual server.
* CVE-2026-107415 (CVSS score: 9.3) - A memory overflow vulnerability in Email OTP authentication can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler ADC or NetScaler Gateway configured with an Email Action.
* CVE-2026-111344 (CVSS score: 9.3) - A memory overflow vulnerability in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler configured as a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis.
* CVE-2026-120864 (CVSS score: 9.3) - A memory overflow vulnerability in ICA proxy can lead to unpredictable or erroneous behavior or DoS attacks. This vulnerability affects NetScaler configured as a Gateway VPN virtual server, an AAA virtual server, or a CR virtual server of type HDX.

In addition to the vulnerabilities in NetScaler ADC and NetScaler Gateway, the patches also address a number of flaws in NetScaler Console and Secure Access Client for Windows and Linux.

* CVE-2026-120869 (CVSS score: 9.4) - An improper authentication vulnerability in NetScaler Console can allow an unauthenticated attacker to bypass authentication controls to access restricted resources on the appliance. This vulnerability has been fixed in NetScaler Console 14.1-74.34 and later releases.
* CVE-2026-118268 (CVSS score: 8.5) - An improper privilege management vulnerability in Secure Access Client for Windows can allow a low-privileged user to escalate privileges to SYSTEM. This vulnerability has been fixed in Secure Access Client for Windows 26.11.1.6 and later releases.
* CVE-2026-118269 (CVSS score: 8.5) - An improper privilege management vulnerability in Secure Access Client for Linux can allow a low-privileged user to gain root privileges. This vulnerability has been fixed in Secure Access Client for Linux 26.10.4 and later releases.

Citrix has stated that it is not aware of any exploits for any of the announced vulnerabilities, but urged customers to apply the updates as they are designed to "enhance the security posture of NetScaler."

The security updates were made possible by the integration of AI-assisted code analysis into Citrix's codebase review process. This allows the company to detect and resolve vulnerabilities with an aim to harden the products before potential threats could materialize.

Related Information:

https://www.ethicalhackingnews.com/articles/Citrix-Patches-Critical-Flaws-in-NetScaler-Secure-Access-Client-and-Other-Products-Urges-Customers-to-Apply-Updates-ehn.shtml

https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html

https://nvd.nist.gov/vuln/detail/CVE-2026-120868

https://www.cvedetails.com/cve/CVE-2026-120868/

https://nvd.nist.gov/vuln/detail/CVE-2026-107407

https://www.cvedetails.com/cve/CVE-2026-107407/

https://nvd.nist.gov/vuln/detail/CVE-2026-107408

https://www.cvedetails.com/cve/CVE-2026-107408/

https://nvd.nist.gov/vuln/detail/CVE-2026-107409

https://www.cvedetails.com/cve/CVE-2026-107409/

https://nvd.nist.gov/vuln/detail/CVE-2026-107410

https://www.cvedetails.com/cve/CVE-2026-107410/