Anyone running a NetScaler ADC or Gateway appliance should schedule an upgrade this week. A new Citrix bulletin covers more than two dozen memory-safety bugs, and the worst of them needs no special configuration to be exploitable.
The bug is tracked as CVE-2026-120868 and sits in how the appliance handles network packets, where a memory overflow can be triggered. Most NetScaler flaws only matter when a specific feature is in use, such as a SAML login or an SSL VPN. This one is different: the vendor says every deployment is vulnerable in its default state, so checking your configuration cannot clear you. The outcome can be erratic behaviour or a denial of service, and the scoring vector shows it can be reached over the network without logging in.
The rest of the list is a long tail of the same kind of fault, each tied to a feature. Affected areas include DNS and DNS-over-HTTPS, SMPP traffic, NetScaler Push, Email OTP and SAML login, client-certificate authentication, HTTP/2 and HTTP/3, GSLB, Diameter, MQTT, RADIUS and BGP routing. Citrix’s security bulletin gives, for each one, the setting that makes an appliance vulnerable and the configuration lines to search for, so admins can see which of the 27 other bugs actually apply to them. A different kind of entry involves no crash: after a logout, someone with local read access to the appliance could view sensitive data left in a log file.
The bulletin applies to customer-managed appliances. The patched releases are 14.1-73.57 and 13.1-64.39 for the standard branches. FIPS users need 14.1-73.58, and the FIPS and NDcPP builds of 13.1 need 13.1-37.293. Anything on 14.1 or 13.1 before those versions is affected. Secure Private Access hybrid deployments that use NetScaler instances need the same upgrade, while Cloud Software Group updates its own managed cloud services and Adaptive Authentication itself.
The vendor thanks watchTowr and security teams at JPMorgan Chase and Capital One for reporting bugs. Cloud Software Group’s in-house security staff turned up several more using AI-assisted code analysis. It “strongly urges” customers to install the updated versions as soon as possible.
Some conditions are narrow. The routing flaw, for instance, is only a risk if an attacker can pose as a BGP neighbour the appliance trusts and no password protects that session. Other bugs need the box to act as a remote-access gateway, to host a login server, or to have newer options such as HTTP/3 or encrypted client hello turned on. Where a feature is off, its bug does not apply, yet the default-configuration flaw still makes an upgrade unavoidable.
The practical order for admins is to find the running version, upgrade to the matching fixed build, and keep the appliance’s management address (NSIP) off untrusted networks, since the bulletin says one of the bugs is reachable through it.
