CERT-EU issues advisory on 28 NetScaler memory flaws including CVE-2026-120868

This is a new development in a story we reported earlier: Citrix patches 12 NetScaler and Secure Access Client flaws.

CERT-EU published a security advisory on Nov. 12, 2026 covering 28 memory flaws in Citrix NetScaler ADC and NetScaler Gateway disclosed by Cloud Software Group.n

This is a new development in the continuing Citrix NetScaler patch story. NetScaler ADC and Gateway sit at the network perimeter. The September 2026 zero-days CVE-2026-88771 and CVE-2026-88772 were actively exploited on those appliances. CVE-2026-88771 lets attackers run commands without logging in on all deployments including defaults, while CVE-2026-88772 is a memory overflow causing code execution or crashes that requires DTLS, a setting enabled by default on VPN servers; both score 9.5, and attackers exploited them before patches existed.

The lead flaw, CVE-2026-120868, scored 9.3 and is a memory overflow in the appliance’s core packet processing. It reaches every NetScaler ADC and Gateway deployment, including default builds, without requiring authentication. The vendor describes the impact as unpredictable behaviour and denial of service, and Citrix reports no exploitation of the announced vulnerabilities and no public proof of concept.

CERT-EU recommends upgrading all customer-managed NetScaler ADC and Gateway appliances to fixed releases, prioritizing internet-facing Gateway and AAA appliances. Affected standard versions are NetScaler ADC and Gateway 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39. Fixed FIPS releases are 14.1-FIPS 14.1-73.58 FIPS and later and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later.

The vendor rates 10 of the 28 flaws as high impact on confidentiality, integrity and availability, though it cites only unpredictable behaviour or denial of service. CVE-2026-107412, scored 9.5, covers multiple memory overflows reaching Gateway or AAA virtual servers without authentication. Other flaws depend on SAML, WebAuth, LDAP, Email OTP, client certificates, DNS-over-HTTPS, HTTP/2, HTTP/3, SMPP, RTSP, BGP and the Application Firewall.

Cloud Software Group also patched CVE-2026-120869 in NetScaler Console, scored 9.4, which lets unauthenticated attackers access restricted resources; it is fixed in Console 14.1-74.34 and later. In Secure Access Client for Windows, CVE-2026-118268 scored 8.5 and lets low-privileged users reach SYSTEM, fixed in 26.11.1.6 and later. The Linux client flaw CVE-2026-118269, also scored 8.5, lets low-privileged users gain root and is fixed in 26.10.4 and later.

Several 9.3 flaws are feature-gated. CVE-2026-107407 is an SMPP traffic memory overflow on load balancing or content switching virtual servers of type SMPP. CVE-2026-107408 is DNS or DNS-over-HTTPS memory corruption on appliances doing DNS load balancing and recursive DNS resolution.

CVE-2026-107415 is an Email OTP authentication memory overflow on appliances with an Email Action. CVE-2026-111344 is an Endpoint Analysis memory overflow on VPN or AAA virtual servers with Endpoint Analysis. CVE-2026-120864 is an ICA proxy memory overflow on Gateway VPN, AAA, or CR virtual servers of type HDX. Citrix said the patches follow a codebase review using AI-assisted code analysis to harden products before threats emerge, a step the company said will

Shadowserver tracks more than 21,000 internet-exposed NetScaler IP addresses, including over 1,500 Gateways and nearly 20,000 NetScaler ADC appliances. It is unknown how many exposed instances are honeypots, already patched, or running vulnerable configurations.

Earlier NetScaler issues show the recurrence. Citrix warned in October 2026 that CVE-2026-107406 can cause remote code execution or denial-of-service crashes on SAML Identity Provider or Service Provider configurations. In early October 2026 the vendor issued emergency updates for denial-of-service zero-day CVE-2026-88779, which researchers said could also enable remote code execution. In March 2026 Citrix urged customers to patch CVE-2026-3055 and CVE-2026-4368.

CISA has tracked 27 actively exploited Citrix vulnerabilities since November 2021, including seven used in ransomware attacks.

CISA added CVE-2026-88771 and CVE-2026-88772 to its known exploited vulnerabilities list and ordered federal civilian agencies to patch by Sept. 30, 2026, and urged organizations to check for compromise before applying patches because patching can remove forensic evidence. The Dutch National Cyber Security Centre said CVE-2026-88771 lets attackers fully control the gateway and reach the network behind it, and noted that Citrix found the flaws while investigating customer incidents and notified the EU under the Cyber Resilience Act.

Mandiant and Google Threat Intelligence Group know of dozens of compromised organizations across North America and Europe in government, finance, education, telecom and legal services. Mandiant CTO Charles Carmakal said suspected state-sponsored actors are likely behind the first intrusions involving CVE-2026-88772, and that exploitation of that flaw began no later than early September 2026, with Mandiant and GTIG first flagging it in late September 2026. Carmakal said CVE-2026-88772 exploitation bypasses authentication to gain initial root-level access, and that attackers used web shells for commands and persistence, and used a TCP tunneling tool called SLAPSHOT to route traffic into internal networks.

Charles Carmakal said he expects broad and opportunistic exploitation of CVE-2026-88771 and CVE-2026-88772 by various threat actors, and that spray and pray exploitation of CVE-2026-88771 is already under way after technical details and a proof of concept appeared online. WatchTowr researchers published an analysis of CVE-2026-88772 and a Detection Artefact Generator, indicating wider exploitation likely began already.

Charles Carmakal said upgrading to a fixed version does not remove attackers and does not address the risk from stolen credentials. Google researchers provided detailed threat hunting, containment and remediation guidance for organizations running NetScaler ADC and Gateway.