Loading vulnerability…
Sensitive Authentication Material Logged in Citrix NetScaler ADC and Gateway
CVE-2026-111348 is an information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway that causes sensitive authentication material to be written to an appliance log following logout. An attacker with local read access to the affected log can obtain the exposed material. Customer-managed appliances, including affected NetScaler instances used in Secure Private Access Hybrid deployments, require security updates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Sensitive authentication material can be disclosed to an attacker with local access to read appliance logs. The precise material exposed and whether it remains usable for authentication after logout are not established. Remote unauthenticated exploitation, code execution, and privilege escalation are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vendor-provided interim workaround is specified. As a defense-in-depth measure, restrict local appliance access and access to authentication-related logs to trusted administrators. Access restrictions do not correct the underlying logging behavior.
Patch, then assume compromise.
Install the applicable fixed release or a later release: NetScaler ADC and NetScaler Gateway 14.1-73.57; NetScaler ADC and NetScaler Gateway 13.1-64.39; NetScaler ADC 14.1-FIPS 14.1-73.58; or NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293. Update affected NetScaler instances in Secure Private Access Hybrid deployments as well. Citrix manages updates for its managed cloud services. Attribution is inconsistent: a separate Likeshop IDOR entry uses the same CVE identifier. These remediation details apply to the Citrix issue described in vendor advisory CTX697305, not to Likeshop.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.