Citrix Fixes Critical NetScaler ADC and Gateway Vulnerabilities
Citrix patched critical NetScaler ADC, Gateway and Console flaws that can cause denial of service or authentication bypass, including CVE-2026-120868 (9.3).
⚡ Why it matters
NetScaler appliances are the remote-access front door for many companies and government agencies, and past NetScaler flaws were exploited quickly after disclosure. Patching early makes the difference.
Citrix has fixed a batch of vulnerabilities in NetScaler ADC, NetScaler Gateway and NetScaler Console, as well as its Secure Access client. Reports indicate that some of the critical flaws could lead to denial of service (DoS) or authentication bypass.
The most prominent is CVE-2026-120868, rated 9.3, a memory overflow flaw, according to The Hacker News' summary of the Citrix bulletin.
Why speed matters
In recent years, NetScaler appliances have been hit by widespread exploitation waves just days after patches were released, because attackers analyze the update itself to find the bug.
Recommended steps
- Read the Citrix security bulletin and identify which of your versions are affected.
- Update ADC and Gateway appliances in your earliest maintenance window.
- After updating, terminate active sessions and review login logs for unusual activity.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Critical CVEs: Synology, SharePoint, VS Code and Routers
Here are the most important critical vulnerabilities published in the US NVD between November 9 and 15, 2026, from Synology and Microsoft to developer tools, WordPress plugins and old home routers, with what to do for each.
Claude 'Office Party' Skills Flaw Runs Code on Linux
AIR Security disclosed Office Party, a flaw in Claude's official Word, PowerPoint and Excel skills that can run malicious code on Linux once a file is planted in a shared temp folder. Anthropic has chosen not to fix it.
Windows Paint Flaw CVE-2026-83844: Update via the Store
Microsoft patched a remote code execution flaw, `CVE-2026-83844`, in Windows Paint after nearly a month of confusion over the fixed version and its Store availability. The safe version is 11.2609.401.0.