NetScaler Console

Citrix Patches Nine Critical NetScaler ADC and Gateway Flaws Plus One in Console

Citrix has released patches addressing 28 vulnerabilities across NetScaler ADC, NetScaler Gateway, and NetScaler Console. Nine of the issues in ADC and Gateway are rated critical and originate from memory overflow conditions in Packet Processing, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP authentication, Endpoint Analysis, and ICA proxy. These flaws can trigger unpredictable behavior or denial-of-service conditions. A separate critical vulnerability in NetScaler Console, tracked as CVE-2026-120869 with a CVSS score of 9.4, allows unauthenticated attackers to bypass access controls. The remaining defects are mostly high-severity and affect similar functionality. Patches are available for NetScaler ADC and Gateway versions 14.1-73.57 and later, 13.1-64.39 and later, plus corresponding FIPS and NDcPP builds. Citrix recommends immediate updates and has disclosed precondition details for several of the issues.