Citrix Patches 28 NetScaler Vulnerabilities, Including Critical Flaws

SecurityWeek reports that Citrix announced patches on Thursday for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical-severity bugs. The critical flaws stem from memory overflow issues in several components and could lead to unpredictable or erroneous behavior or denial-of-service (DoS) conditions. Most of the remaining 19 defects are high-severity weaknesses with similar outcomes, and several medium-severity bugs were also patched, including CVE-2026-111338, which exposes sensitive authentication material in a log file.

Citrix also patched CVE-2026-120869, a critical-severity flaw in NetScaler Console with a CVSS score of 9.4, which could allow unauthenticated attackers to bypass controls and access restricted resources. The flaw affects all NetScaler Console 14.1 releases before 14.1-74.34. Citrix urges customers to update their instances as soon as possible. According to SecurityWeek, Citrix makes no mention of any of these vulnerabilities being exploited in the wild.

Why it matters Organizations running NetScaler ADC, NetScaler Gateway or NetScaler Console should check their versions against the fixed builds and prioritize updates, since vulnerabilities in NetScaler are a frequent target for threat actors. Citrix has not reported exploitation in the wild, so the absence of known attacks should not delay patching. Security teams should also review log handling, because one medium-severity flaw exposes sensitive authentication material.