Citrix NetScaler Bulletin CTX697305: 28 Flaws Fixed, Patch Now
Citrix has fixed 28 flaws in NetScaler ADC and Gateway, including one that affects every appliance. Here are the affected versions, fixed builds and patch steps.
Image: TeQBlogs
Citrix has released a critical security bulletin for Citrix NetScaler ADC and NetScaler Gateway that fixes 28 vulnerabilities, nine of them rated 9.3 or higher out of 10. One flaw, CVE-2026-120868, affects every NetScaler ADC and Gateway deployment, including the default configuration. Bulletin CTX697305 was published on 12 November 2026, and Citrix “strongly urges” customers who manage their own appliances to upgrade to a fixed build as soon as possible.
Quick summary
- What: Citrix security bulletin CTX697305, rated Critical, covering 28 CVEs in NetScaler ADC and NetScaler Gateway.
- Published: 12 November 2026, last modified 13 November 2026.
- Most serious: CVE-2026-107412 (CVSS 9.5) on Gateway and AAA virtual servers, and CVE-2026-120868 (CVSS 9.3), which needs no special feature to be enabled.
- Fixed builds: 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS/NDcPP, or later.
- Workaround: the bulletin lists none. Upgrading is the fix.
- Citrix-managed cloud: Citrix says it updates its own managed cloud services; this bulletin is for customer-managed appliances.
What is the Citrix NetScaler security bulletin CTX697305?
CTX697305 is Citrix’s November 2026 security bulletin for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). These appliances sit at the edge of company networks as load balancers and remote-access gateways, so staff VPN logins and published apps often pass through them. That position makes any serious NetScaler flaw a priority for IT teams.
The bulletin lists 28 CVEs. Most are memory-safety bugs, such as memory overflows, out-of-bounds writes and a double free, which Citrix says can lead to “unpredictable or erroneous behavior” or denial of service. Citrix does not say in the bulletin that any of the flaws is being exploited.
Also read: emSign Certificate Distrust: What Changes on 16 November and What to Do
Which Citrix NetScaler versions are affected?
All supported branches are affected until they reach the fixed build. NetScaler versions that are already end of life do not receive fixes, so appliances on those need to move to a supported release.
| Product branch | Affected | Fixed build |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | Before 14.1-73.57 | 14.1-73.57 and later |
| NetScaler ADC and Gateway 13.1 | Before 13.1-64.39 | 13.1-64.39 and later 13.1 releases |
| NetScaler ADC 14.1-FIPS | Before 14.1-73.58 FIPS | 14.1-73.58 FIPS and later |
| NetScaler ADC 13.1-FIPS and 13.1-NDcPP | Before 13.1-37.293 | 13.1-37.293 and later |
Citrix adds that Secure Private Access Hybrid deployments that use NetScaler instances are also affected and need the same upgrade.
The most serious flaws in the bulletin
Nine of the 28 CVEs score 9.3 or above on CVSS v4.0. Whether each one applies to you depends on which NetScaler features you use, except for the first row, which applies to everyone.
| CVE | CVSS v4.0 | Applies when |
|---|---|---|
| CVE-2026-120868 | 9.3 | Always: all deployments, including default configuration (memory overflow in packet processing) |
| CVE-2026-107412 | 9.5 | NetScaler is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server |
| CVE-2026-107407 | 9.3 | A load balancing or content switching virtual server of type SMPP is configured |
| CVE-2026-107408 | 9.3 | DNS load balancing and recursive DNS resolution are configured |
| CVE-2026-107409 | 9.3 | DNS load balancing over HTTPS (DoH) is configured |
The remaining CVEs score between 6.9 and 8.7. Because CVE-2026-120868 needs no optional feature, there is no configuration that makes an unpatched appliance safe from the whole bulletin.
How to check and patch your NetScaler
- Find your build. Log in to the NetScaler CLI and run
show ns version, or check the version shown in the management GUI. - Compare it with the fixed builds in the table above. If your build number is lower, the appliance is affected.
- Check your exposure. Citrix’s bulletin gives a configuration check for each CVE. For example,
add vpn vserveroradd authentication vserverentries in the configuration mean the Gateway/AAA flaw (CVE-2026-107412) applies. - Back up first. Save the running configuration and take a backup of the appliance before upgrading.
- Download the fixed build from Citrix’s official downloads page using your Citrix account. Do not use firmware from third-party sites.
- Upgrade in a maintenance window. In a high-availability pair, upgrade the secondary node first, then fail over and upgrade the other node.
- Confirm the result. Run
show ns versionagain and test VPN logins and published apps.
Prioritise internet-facing Gateway and AAA virtual servers, since those are reachable from outside and carry the highest-scored flaw. As general good practice, keep the NetScaler management IP (NSIP) off the public internet.
NetScaler Console and Secure Access Client also need updates
Citrix published related critical bulletins on the same day. CTX697320 covers NetScaler Console: CVE-2026-120869 (CVSS 9.4) lets an unauthenticated attacker with access to the Console IP bypass authentication. It affects NetScaler Console 14.1 before 14.1-74.34. Citrix also lists bulletins CTX697280 and CTX697281 for the Citrix Secure Access client on Windows and Linux, so check those if your users run that client.
What this means for Indian businesses
NetScaler is widely used by banks, IT services firms, hospitals and government bodies for remote access, and many smaller companies inherit one through a hosted or managed setup. If a partner manages your appliance, ask them in writing which build you are on and when the upgrade is planned. Edge devices have been a favourite target in past attack waves, so do not leave this for the next quarterly cycle.
If you need help reviewing gateway and perimeter security, Suprams’ firewall and network security team works with businesses on this. Related reading: this week’s November 2026 Patch Tuesday, the Zyxel GS1900 vulnerability, the SSHole OpenSSH flaw and our guide to common cyber security threats.
Frequently asked questions
Is the Citrix NetScaler vulnerability being exploited?
Citrix’s bulletin CTX697305 does not report exploitation of any of the 28 flaws. That can change quickly after a patch is released, so upgrade without waiting.
Which NetScaler version fixes CVE-2026-120868?
NetScaler ADC and Gateway 14.1-73.57 and later, 13.1-64.39 and later 13.1 releases, 14.1-73.58 FIPS, and 13.1-37.293 for 13.1-FIPS and NDcPP.
Is there a workaround instead of upgrading?
No workaround is listed in the bulletin. Citrix’s guidance is to install the updated versions as soon as possible.
Do Citrix cloud customers need to do anything?
Citrix says it upgrades its own Citrix-managed cloud services and Citrix-managed Adaptive Authentication. Customers must upgrade any NetScaler appliances they manage themselves.
The bottom line
This is a large, critical NetScaler update, and one of its flaws affects every appliance regardless of configuration. Check your build today with show ns version, upgrade to the fixed release for your branch, and start with internet-facing gateways. Then check NetScaler Console and the Secure Access client against Citrix’s related bulletins.
Sources
- Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin CTX697305
- Citrix: NetScaler Console Security Bulletin CTX697320 (CVE-2026-120869)
About The Author
