Citrix has released patches for 28 vulnerabilities in its NetScaler ADC and NetScaler Gateway products, including nine critical flaws that could lead to denial-of-service conditions or unpredictable behavior. The company is urging customers to update their instances as soon as possible.
The critical vulnerabilities affect NetScaler ADC and NetScaler Gateway versions 14.1-73.57 and later, and 13.1-64.39 and later, among others. They stem from memory overflow issues in various components of the products, including Packet Processing, SMPP traffic, DNS/DNS-over-HTTPS (DoH), and ICA proxy. If exploited, these flaws could allow attackers to disrupt or compromise network services.
In addition to the critical vulnerabilities, Citrix has also patched 19 high-severity weaknesses that could lead to similar outcomes. Some of these issues are related to authentication processes, while others affect how the products handle network traffic. The company has also addressed several medium-severity bugs, including one that exposes sensitive authentication material in a log file.
Citrix’s announcement comes as threat actors continue to target vulnerabilities in NetScaler products. While there is no indication that any of these flaws have been exploited in the wild, it’s essential for customers to stay on top of updates and patches to minimize their exposure.
Another critical vulnerability was patched by Citrix in its NetScaler Console product. Tracked as CVE-2026-120869, this flaw could allow unauthenticated attackers to bypass controls and access restricted resources. The issue affects all NetScaler Console 14.1 releases before 14.1-74.34.
Citrix’s patches are available for download now, but it’s crucial for customers to review the release notes and preconditions associated with each vulnerability. By staying informed and taking prompt action, users can help prevent potential attacks and maintain their network security.
In light of this announcement, we recommend that all NetScaler ADC and Gateway administrators review the patch notes and update their instances as soon as possible. Regularly reviewing your systems for updates and patches is an essential step in maintaining robust cybersecurity defenses.
Source: SecurityWeek — 2026-11-13