What Happened
The Hacker News reported on November 12, 2026 that Citrix has released patches for multiple critical security flaws affecting NetScaler ADC, Citrix NetScaler Gateway and NetScaler Console, which could lead to denial-of-service or an authentication bypass. One critical NetScaler ADC vulnerability in the batch is CVE-2026-120868, described as a memory overflow vulnerability with a CVSS score of 9.3. The same release also covers Secure Access Client for Linux and Secure Access Client for Windows.
SecurityWeek reported the patch batch on November 13, 2026 under the headline Citrix Patches 10 Critical NetScaler Vulnerabilities, noting that successful exploitation could lead to unexpected behavior or denial-of-service conditions. The two reports count the set differently. The Hacker News counts 12 NetScaler and Secure Access Client flaws, while SecurityWeek focuses on 10 critical NetScaler vulnerabilities. Neither source reports exploitation in the wild.
For an MSP this is a version check and patch job, not a detection job. NetScaler ADC and Gateway are commonly internet-facing, and an authentication bypass on a perimeter device is a login-layer problem. The clients at risk are the ones whose staff, partners or customers reach an application through that gateway.
Why the NetScaler ADC Vulnerability Matters to MSPs
Perimeter devices change the patch calendar. When a memory overflow or an authentication bypass lands on a gateway, the usual internal change window is the wrong risk model. In general, a flaw on a device that anyone on the internet can reach is more urgent than the same flaw on an internal server, because the exposed surface is already open.
MSPs also carry the documentation burden. When a client asks whether their gateway was affected, you want a version list you can produce, not a guess. That list is also what tells you which instances to patch first.
Timeline
- November 12, 2026: The Hacker News publishes its report on Citrix patches for 12 NetScaler and Secure Access Client flaws, including an authentication bypass.
- November 13, 2026: SecurityWeek publishes Citrix Patches 10 Critical NetScaler Vulnerabilities, stating that successful exploitation could lead to unexpected behavior or denial-of-service conditions.
Who Is Affected
The sources list these affected versions in the patch batch:
- NetScaler ADC and NetScaler Gateway prior to 13.1-64.39 and prior to 14.1-73.57
- NetScaler ADC FIPS prior to 14.1-73.58 FIPS and prior to 13.1-37.293 FIPS & NDcPP
- NetScaler Console prior to 14.1-74.34
- Secure Access Client for Linux prior to 26.10.4
- Secure Access Client for Windows prior to 26.11.16
Technical Details
The critical issue in the batch is CVE-2026-120868, a memory overflow vulnerability in NetScaler ADC and Citrix NetScaler Gateway, with a CVSS score of 9.3. The other CVE identifiers associated with the batch are CVE-2026-120869, CVE-2026-118269 and CVE-2026-118268. The sources describe the impact of the set as denial-of-service or an authentication bypass.
SecurityWeek states that successful exploitation could lead to unexpected behavior or denial-of-service conditions. The sources do not publish a detailed attack vector for CVE-2026-120868 beyond the memory overflow description and the CVSS score. There is no proof-of-concept detail, no exploitation report and no named target list in the material summarised here. The version list is the actionable part.
What MSPs Should Do
Work from an inventory, not from memory. The source guidance for this batch is to review the vendor links and apply updates as they become available.
- Inventory every client instance of NetScaler ADC, Citrix NetScaler Gateway, NetScaler Console and Secure Access Client for Linux or Windows. Include inherited appliances, lab units and anything you do not actively manage.
- Check the running version on each instance against the fixed versions listed above. Anything older needs a patch plan.
- Rank by exposure. Internet-facing gateways and ADC instances first, console and client installs after.
- Apply the vendor updates so each instance reaches the fixed version for its product family. Use the vendor advisory as the authority for the exact build.
- Verify the version after the update. Do not trust a successful install message alone.
- Watch for regressions after patching. A gateway that fails after an update is an outage of its own.
- Document what you patched and when, so you can answer a client who asks whether their gateway was affected.
- For any client who cannot patch immediately, review the exposure with them and schedule the update.
How EnterProtect Helps
Patching is the fix for this batch, and it happens on the client's device. EnterProtect is the backup and recovery layer underneath that work. EnterProtect backup keeps clean, restorable copies of client systems and data, so there are clean copies to restore if an update fails or a device has to be rebuilt. Recovery gets a client running again from those copies when an appliance or a dependent server needs to be restored.
EnterProtect vulnerability scanning is a standing way to keep visibility of what versions are running where across client environments. Used as a routine, it gives you a current inventory to work from when a vendor patch batch lands, instead of rebuilding the list under time pressure.
Backup and recovery do not block or detect this flaw. They are what you fall back on when prevention fails and a client needs to be back up.
Frequently Asked Questions
What Is CVE-2026-120868?
CVE-2026-120868 is a memory overflow vulnerability in NetScaler ADC and Citrix NetScaler Gateway with a CVSS score of 9.3. The Hacker News listed it among the critical flaws in Citrix's patch batch. It is the highest-profile issue in the set summarised here.
Which NetScaler Versions Are Affected?
NetScaler ADC and NetScaler Gateway before 13.1-64.39 and before 14.1-73.57 are listed as affected. NetScaler ADC FIPS before 14.1-73.58 FIPS and before 13.1-37.293 FIPS & NDcPP, and NetScaler Console before 14.1-74.34, are also in scope. Secure Access Client for Linux before 26.10.4 and for Windows before 26.11.16 are listed too.
Is the Citrix NetScaler Flaw Being Exploited?
The two reports summarised here do not state that the flaws are being exploited in the wild. No exploitation report is attached to this batch. Treat it as a patch-now situation and check your own monitoring for unusual activity on exposed gateways.
How Do I Check Whether My Clients Are Affected?
Compare the running versions of NetScaler ADC, NetScaler Gateway, NetScaler Console and both Secure Access Client builds against the fixed versions. Anything below those builds needs an update. Start with instances exposed to the internet, because those carry the most risk.
What Is the CVSS Score of the NetScaler ADC Vulnerability?
CVE-2026-120868 carries a CVSS score of 9.3, which sits in the critical range. The score comes from the report by The Hacker News. The other CVE identifiers in the batch do not have published scores in the material summarised here.
Do MSPs Need to Patch NetScaler Gateway as Well as ADC?
Yes. The patch batch covers both NetScaler ADC and Citrix NetScaler Gateway, and CVE-2026-120868 is listed against both products. NetScaler Console and the Secure Access Client builds are also in scope for the release. Patch all of them where they are deployed.
Sources
- Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass (Hackernews)
- Citrix Patches 10 Critical NetScaler Vulnerabilities (Securityweek)