Citrix Patches Critical NetScaler Flaws, Console Authentication Bypass and Client Privilege Escalation

Citrix released security updates for NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client for Windows and Linux. Nine critical ADC and Gateway vulnerabilities, rated CVSS 9.3–9.5, can cause denial of service or unpredictable behavior; the broader set of NetScaler flaws also includes credential-exposure risks. Most require specific deployment configurations, but CVE-2026-120868 affects ADC and Gateway in their default configuration. The highest-rated flaw, CVE-2026-107412, scores 9.5 and requires Gateway or AAA virtual server functionality. Hybrid Secure Private Access deployments containing NetScaler instances are also affected.

A separate NetScaler Console vulnerability allows unauthenticated access to restricted resources, while Secure Access Client flaws permit local privilege escalation to SYSTEM on Windows or root on Linux. Citrix said the updates followed an AI-assisted code review and reported no known exploitation of the announced vulnerabilities. Administrators should prioritize applicable fixed releases or newer versions, checking deployment-specific prerequisites rather than assuming default configurations are unaffected. Citrix also announced a monthly security update schedule, with exceptions for urgent fixes.