Citrix NetScaler ADC and Gateway: 28 Flaws, 2 Critical

On November 12, 2026, the Cloud Software Group published security bulletins covering 28 memory-safety flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. CERT-EU tracked them as advisory 2026-020 on November 13, and the message from CERT-EU is blunt: upgrade.

Two of the flaws should stop everyone.

CVE-2026-120868, at CVSS 9.3, is a memory overflow in the core packet processing path. It does not require any special feature to be enabled — it affects every deployment, including the default configuration. CVE-2026-107412, at CVSS 9.5, covers a set of memory overflow vulnerabilities aimed at appliances configured as a Gateway — SSL VPN, ICA Proxy, CVPN or RDP Proxy — or as an AAA virtual server.

Affected versions: NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, NetScaler ADC FIPS before 14.1-73.58 FIPS, and NetScaler ADC FIPS and NDcPP before 13.1-37.293. Appliances in Gateway or AAA virtual server roles are the priority, because those are the roles an attacker can reach from outside your network.

The bulletin covers both appliance and management-path components. Whether your instance is configured to expose the vulnerable components to the internet matters less than the fact that the components are present in all deployments.

There is no report of active exploitation, and no public proof of concept has been confirmed. CERT-EU’s advice, framed for the public sector, applies verbatim to anyone else: upgrade all customer-managed appliances, and upgrade internet-facing Gateway and AAA appliances first.

There is no mitigation that does not involve patching. If you cannot patch immediately, segregate the appliances and restrict inbound access to the Gateway and AAA roles rather than leaving them exposed while you wait for a change window.