Attackers can take Citrix NetScaler ADC and NetScaler Gateway offline

Attackers can exploit several vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, which can also cause instances to crash. Nine of the 28 vulnerabilities are considered “ critical ”. Security patches are available for download.

According to a security advisory , one “ critical ” vulnerability (CVE-2026-120868) affects both products in their default configuration. The flaw is in packet processing. A memory error can lead to unpredictable behavior or denial-of-service (DoS) conditions.

For attackers to exploit the remaining vulnerabilities, NetScaler ADC and NetScaler Gateway must each have specific configurations. For example, further DoS attacks require DNS load balancing over DNS-over-HTTPS (CVE-2026-107409 “ critical ”) or DNS load balancing with recursive DNS resolution (CVE-2026-107408 “ critical ”) to be enabled.

CVE-2026-107412 is considered the most dangerous (“ critical ”, CVSS 9.5). To exploit it, NetScaler must be configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.

Most of the remaining vulnerabilities are rated “ high ” severity. DoS attacks are also possible in these cases (for example, CVE-2026-120861). Four vulnerabilities are rated “ medium ”. One of them could cause authentication data to be written to a log file (CVE-2026-111348). However, attackers need local access to read it.

Citrix has not yet reported any cases of attackers exploiting the vulnerabilities. Hybrid Secure Private Access environments with NetScaler instances are also affected. The manufacturer updates cloud services managed by Citrix itself. To protect instances from potential attacks, admins must install one of the following versions or a later one:

Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.57

Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.39

Citrix NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS

Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293

Citrix says in a blog post that it will now release security patches monthly on a fixed schedule, as close as possible to Patch Tuesday. Updates outside this schedule are possible in urgent cases, such as active exploitation. The latest patches are the first under this program. Citrix says it discovered some of the vulnerabilities using AI-assisted code analysis.

Most recently, in early October , a critical vulnerability in Citrix NetScaler made headlines.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.