If you run Citrix NetScaler ADC or NetScaler Gateway, patch again. I know — you just did this in October. Citrix published a new security bulletin, CTX697305, on November 12, covering 28 memory-safety vulnerabilities in NetScaler ADC and NetScaler Gateway. Nine of them are rated critical at 9.0 or higher. And the worst part is not the count. It is that one of them hits every deployment, including a box left in its default configuration.
What happened
The highest score in the bulletin is CVE-2026-107412, at 9.5. Citrix describes it as multiple memory overflows reachable without authentication on appliances configured as a Gateway — SSL VPN, ICA Proxy, CVPN, or RDP Proxy — or as an AAA virtual server. Those are the remote-access boxes people log into from home, which is exactly why that score is high.
The flaw I care about more is CVE-2026-120868, at 9.3. It is a memory overflow in core packet processing. There is no special feature to turn on, no login required, and no workaround. Citrix’s own wording, quoted in the reporting, is that all NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration. A plain load balancer that has never been a VPN is in scope for this one.
The rest of the bulletin follows the usual NetScaler pattern: memory overflows tied to specific configurations, including SAML authentication, DNS load balancing, Email OTP, and Endpoint Analysis. The fixed builds are 14.1-73.57 and 13.1-64.39 for the standard releases, 14.1-73.58 for 14.1-FIPS, and 13.1-37.293 for 13.1-FIPS and NDcPP. If you updated in October to 14.1-73.49 or 13.1-64.32, you are vulnerable again — those builds predate this bulletin. Citrix also issued companion bulletins the same day, 31 CVEs in total across four bulletins according to SecurityOnline, including a 9.4 authentication bypass, CVE-2026-120869, in NetScaler Console, fixed in Console 14.1-74.34.
Citrix says it is not aware of any exploitation of these flaws, there is no public proof-of-concept reported, and none of these CVEs are in CISA’s Known Exploited Vulnerabilities catalog. Citrix also says some of the flaws were found through AI-assisted code analysis, and that this is the first release under its new monthly security release program.
How bad is it, honestly?
Serious, and urgent, but not a reason to panic if you patch promptly. I want to be precise about two things. First, “not exploited yet” is a statement about today, not a safety guarantee. Edge appliances that sit on the internet and handle logins are exactly the kind of target attackers work on quickly once a bulletin gives them a map. Second, Citrix’s text for most of these flaws says unpredictable behavior or denial of service, while the CVSS vectors beside some of them rate confidentiality, integrity, and availability all High. The bulletin does not reconcile that difference. My rule is simple: plan for the higher reading, because planning for the lower one is what creates a backlog if it turns out wrong.
What makes this bulletin different from a normal NetScaler bulletin is the triage habit it breaks. NetScaler teams usually read the precondition column and patch only the boxes that match. That still works for ordering — internet-facing Gateway and AAA boxes first — but it does not work for deciding what can wait, because CVE-2026-120868 has no precondition. Every appliance needs the upgrade.
What to actually do
First, inventory every NetScaler ADC and Gateway appliance you manage, including both nodes of every high-availability pair. Check the running build — from the NetScaler CLI, show ns version — against the fixed builds above. A patched primary with an unpatched standby is still an exposed appliance after a failover.
Second, upgrade, starting with internet-facing Gateway and AAA appliances, then the rest. There is no workaround for the default-configuration flaw, because the vulnerable path is core packet processing. Turning features off does not fix that one. The upgrade is the response.
Third, do not forget the management side. If you run NetScaler Console, get it to 14.1-74.34 or later for the authentication bypass in the companion bulletin, and keep its management interface off the public internet regardless.
Fourth, if you are still on NetScaler 12.1 or 13.0, treat this as a migration problem, not a patching problem — end-of-life branches do not get this fix. Move to a supported 14.1 build.
My bottom line: if you patched NetScaler in October and thought you were done for the quarter, you are not. Citrix is now on a monthly cadence, and this month’s bulletin includes a 9.3 that applies to every box by default. Patch every appliance, verify the running build afterward, and put the monthly NetScaler release on your calendar from here on.
Sources: Citrix security bulletin CTX697305, published November 12, 2026; ThreatAft, “NetScaler 28 CVEs: 9.5 Overflow, Default Flaw” — threataft.com; Cybersecurity News, “Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations” — cybersecuritynews.com; SecurityOnline, “Citrix NetScaler Vulnerabilities: 31 CVEs Fixed by Citrix” — securityonline.info.