The Story
Enterprise security often focuses on protecting endpoints, applications and cloud workloads. But what happens when the infrastructure connecting all of them becomes the problem?
Citrix NetScaler is widely deployed across enterprises for application delivery, remote access, load balancing and authentication. It sits at a critical point in the network, often exposed to external traffic.
On November 12, 2026, Citrix disclosed 28 vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Several are rated critical, with CVSS scores reaching 9.5.
This is an important security update for organisations relying on NetScaler for business-critical connectivity.
What happened?
The disclosure covers multiple memory corruption and memory overflow vulnerabilities across NetScaler components.
One vulnerability that deserves immediate attention is CVE-2026-120868 (CVSS 9.3). It affects all NetScaler ADC and Gateway deployments, including default configurations.
Another critical vulnerability, CVE-2026-107412 (CVSS 9.5), affects appliances configured as Gateway or AAA virtual servers.
The remaining vulnerabilities extend across several capabilities, including DNS, DNS-over-HTTPS, SMPP, authentication, Application Firewall, HTTP/2 and HTTP/3.
The important point is that these vulnerabilities do not all share the same exposure conditions. Some affect default configurations, while others depend on specific features or services being enabled.
Why should this concern security teams?
NetScaler is not an isolated infrastructure component.
It frequently handles remote employee access, application connectivity and authentication traffic. A compromise or disruption at this layer can affect multiple business services simultaneously.
The default-configuration exposure associated with CVE-2026-120868 makes the situation particularly important. Security teams should not assume that disabling optional features eliminates the overall risk.
For organisations operating internet-facing NetScaler infrastructure, this deserves immediate attention.
Exploitation status
As of November 13, 2026, there is no confirmed exploitation or publicly available proof-of-concept reported in the referenced CERT-EU assessment.
However, waiting for a vulnerability to enter the CISA Known Exploited Vulnerabilities catalogue is not an appropriate remediation strategy.
Internet-facing infrastructure with critical vulnerabilities should be assessed and prioritised before attackers turn public disclosures into practical attack opportunities.
What needs to be done?
Citrix has released security updates for the affected product branches.
Organisations running NetScaler ADC and Gateway should upgrade to the following fixed releases or later:
- NetScaler 14.1: 14.1-73.57
- NetScaler 13.1: 13.1-64.39
- NetScaler 14.1 FIPS: 14.1-73.58 FIPS
- NetScaler 13.1 FIPS / NDcPP: 13.1-37.293
FIPS and NDcPP deployments should follow their respective release requirements.
Security teams should begin with asset discovery, identify affected appliances and validate feature-level exposure. Internet-facing Gateway and AAA deployments deserve priority, but the assessment must cover all ADC and Gateway instances.
Following the upgrade, validate authentication, VPN connectivity, application delivery and critical business services.
The Takeaway
NetScaler is part of the enterprise security perimeter, even if it is managed by the infrastructure team rather than the security team.
This is where vulnerability management needs to go beyond scanning and reporting. Knowing that a critical CVE exists is only the starting point. Knowing where the vulnerable appliance sits, what business services depend on it and how quickly it can be remediated is what matters.
The weakest point in an enterprise security perimeter may not always be an endpoint. Sometimes, it is the gateway protecting everything behind it.
