Citrix has released patches for a large set of flaws in NetScaler ADC and Gateway, SecurityWeek reports, including 10 rated critical, plus more high- and medium-severity issues. There’s also a separate critical fix for NetScaler Console. If you run NetScaler, this is a patch-now day, not a “we’ll get to it in the next maintenance window.”
The critical ADC and Gateway issues can lead to denial of service or other unreliable behavior in several of the product’s network and authentication features. Citrix has not reported any of these vulnerabilities being exploited, but NetScaler bugs get attention quickly once patches are out. Fixed versions include NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later, and the corresponding FIPS and NDcPP builds Citrix lists in the advisory (14.1-73.58 FIPS and later, and 13.1-FIPS / 13.1-NDcPP 13.1-37.293 and later). The Console bug, CVE-2026-120869, is rated 9.4 and can let an unauthenticated attacker reach restricted resources. It affects all NetScaler Console 14.1 releases before 14.1-74.34.
Review before you install: read the release notes yourself, back up your config, and try new versions somewhere you can afford to break first.
My take
If you administer NetScaler, read the advisory and get onto those builds. Don’t wait to see whether someone posts details. These boxes often sit on the front door of a company network, and “Citrix hasn’t seen exploitation yet” is not the same as “nobody will try.”
God Bless, and Happy hacking!
