Citrix patches 12 NetScaler and Secure Access Client flaws

Citrix released patches for 12 security flaws affecting NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client. The vendor said it knows of no exploits for the announced vulnerabilities.

Nine of the flaws hit NetScaler ADC and Gateway deployments, and each carries a CVSS score of 9.3 or 9.5. CVE-2026-120868, a Packet Processing memory overflow rated 9.3, can cause unpredictable or erroneous behavior or denial of service on those deployments. Fixed builds include version 14.1-73.57 and later, version 13.1-64.39 and later for the 13.1 line, 14.1-FIPS build 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP build 13.1-37.293 and later.

CVE-2026-107407, rated 9.3, is a memory overflow in SMPP traffic that affects NetScaler ADC virtual servers of type SMPP for load balancing or content switching. CVE-2026-107408 and CVE-2026-107409, both rated 9.3, are memory corruption flaws in DNS and DNS-over-HTTPS affecting load-balancing configurations. CVE-2026-107410, rated 9.3, is a memory overflow in NetScaler Push on virtual servers of type PUSH for load balancing.

CVE-2026-107412, rated 9.5, involves multiple memory overflow vulnerabilities on Gateway or AAA virtual servers. CVE-2026-107415, rated 9.3, is a memory overflow in Email OTP authentication on systems set up with an Email Action. CVE-2026-111344, rated 9.3, is a memory overflow in Endpoint Analysis on VPN or AAA virtual servers. CVE-2026-120864, rated 9.3, is a memory overflow in ICA proxy on Gateway VPN, AAA, or CR virtual servers for HDX.

CVE-2026-120869, rated 9.4, is an improper authentication vulnerability in NetScaler Console that lets an unauthenticated attacker bypass controls and reach restricted resources. NetScaler Console 14.1-74.34 and later releases fix it.

CVE-2026-118268, rated 8.5, is an improper privilege management flaw in Secure Access Client for Windows that lets a low-privileged user gain SYSTEM privileges. Version 26.11.1.6 fixes it. CVE-2026-118269, rated 8.5, is the same class of flaw in Secure Access Client for Linux, letting a low-privileged user gain root privileges; version 26.10.4 fixes it.

Citrix said the updates follow a deeper codebase review using AI-assisted code analysis to find and fix vulnerabilities. The vendor urged customers to apply the updates to improve the security posture of NetScaler. Administrators should list every NetScaler ADC, Gateway, Console, and Secure Access Client deployment and install the fixed builds once they know the correct versions.

CISA’s Known Exploited Vulnerabilities catalog includes 10 NetScaler flaws, with six added during the past two years, and the agency says 22 Citrix vulnerabilities were exploited in the wild during the past five years, with six also used in ransomware attacks. ShadowServer Foundation monitors more than 22,000 NetScaler ADC and almost 1,800 NetScaler Gateway instances facing the internet.

Citrix has seen exploitation of CVE-2025-7775, a memory overflow rated 9.2 that lets a remote attacker seize or crash a system, against appliances without mitigations. That flaw hits particular NetScaler ADC and Gateway builds across the 12.1, 13.1, and 14.1 release lines.

Attackers compromised critical infrastructure organizations in the Netherlands through CVE-2025-6543, a memory-overflow flaw in NetScaler products, after intruders entered targets’ networks in early May, over a month before Citrix disclosed the flaw on June 25. Shadowserver Foundation data shows more than 4,100 NetScaler instances worldwide exposed to CVE-2025-6543 and more than 3,300 exposed to CVE-2025-5777, an insufficient-input-validation vulnerability Citrix disclosed as critical in June 2025.

CVE-2026-19490, rated 9.3 on CVSS v4.0, lets remote attackers with no privileges bypass authentication on appliances set up as an AAA virtual server or Gateway. Rapid7 reported no observed exploitation of that flaw through August 19, 2026, but urged organizations to treat patching as an emergency because Citrix products attract rapid exploitation after disclosure.

CVE-2026-88779, a memory overflow in SAML rated 8.7 on CVSS 4, exists only in customer-managed NetScaler setups acting as a SAML Service Provider or Identity Provider. Citrix observed targeted attacks on unmitigated deployments involving the flaw that can lead to denial of service, though the vendor says it has no confirmation the flaw does anything beyond causing a system crash. Kevin Beaumont said the flaw seemed to go beyond denial of service by causing malware execution on devices. “It’s a new security vuln, zero day.”

CVE-2026-88771 lets attackers without credentials execute commands on any device, and CVE-2026-88772 is a memory corruption flaw enabling attackers to execute code or take a device offline. On September 25, the Dutch National Cyber Security Center told government agencies to remove their Citrix NetScaler systems from service because actively exploited vulnerabilities endangered remote workers.

WatchTowr first flagged the vulnerabilities publicly, and Cloud Software Group published patches on September 27 for CVE-2026-88771 through CVE-2026-88778 and six other flaws. On September 27, CISA placed the exploited NetScaler flaws in its Known Exploited Vulnerabilities catalog, and Palo Alto’s Unit 42 reported wide-scale scanning and testing once the vulnerabilities were publicly disclosed.