Citrix on Thursday announced patches for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, including nine critical-severity bugs.
The critical flaws stem from memory overflow issues in Packet Processing, SMPP traffic, DNS / DNS-over-HTTPS (DoH), NetScaler Push, Email OTP authentication, Endpoint Analysis (EPA/EPAS), and ICA proxy, and could lead to unpredictable/erroneous behavior or denial-of-service (DoS) conditions.
They are tracked as CVE-2026-120868, CVE-2026-107407 to CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111334, and CVE-2026-120864.
Most of the remaining 19 security defects are high-severity weaknesses leading to similar outcomes. Citrix also patched several medium-severity bugs, including CVE-2026-111338, which exposes sensitive authentication material in a log file.
NetScaler ADC and Gateway versions 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later contain the relevant patches.
Citrix urges customers to update their instances as soon as possible, and details CVE preconditions associated with some of the vulnerabilities.
On Thursday, the company also announced patches for a critical-severity flaw in NetScaler Console. Tracked as CVE-2026-120869 (CVSS score of 9.4), it could allow unauthenticated attackers to bypass controls and access restricted resources.
The security defect impacts all NetScaler Console 14.1 releases before 14.1-74.34.
Citrix makes no mention of any of these vulnerabilities being exploited in the wild, but vulnerabilities in NetScaler are a frequent target for threat actors.
Related: Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Related: PHP2Shell Exploited in Destructive Check Point Gateway Attacks
Related: Chrome, Firefox Updates Patch Over 180 Vulnerabilities
Related: Hackers Deploy Malware in Fresh ScreenConnect Campaign
