CVE-2026-120868: NetScaler Critical Flaw in Default Configuration, 28 Vulnerabilities Patched at Once

CVE-2026-120868 is a CVSS 9.3-scored memory overflow vulnerability in the NetScaler ADC and NetScaler Gateway packet processing engines, which applies to all deployments in the default configuration, without login and without additional features. This flaw was announced on November 12, 2026 via bulletin CTX697305 along with 27 other flaws, and was fixed in builds 14.1-73.57 and 13.1-64.39. As of the writing of this article, there have been no reports of exploitation and this loophole has not yet been included in CISA KEV.

For admins in Indonesia, NetScaler is usually the VPN gateway and core application load balancer, so the disruption here is immediately felt by users. This article discusses where the loopholes are, who is affected, safe builds, how to check versions, and safe update sequences.

Quick summary of CVE-2026-120868

How does the CVE-2026-120868 vulnerability work?

This flaw operates in the most basic layers of NetScaler: the code that processes network packets can write past memory limits when it receives certain traffic. Because all traffic passes through this layer, the appliance is impacted regardless of which features are enabled.

The vendor did not specify what kind of package triggered the problem, only calling the impact unexpected behavior or denial of service. The bulletin does not state any remote code execution.

How is it different from the other 27 gaps in the same bulletin?

The difference is in the conditions: most other vulnerabilities only open if certain features are active, while CVE-2026-120868 does not require any features. Three other groups to pay attention to:

• CVE-2026-107412 (score 9.5), the highest score in the bulletin. Applies if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
• Gaps in optional features such as SAML, LDAP, Email OTP, DNS-over-HTTPS, HTTP/2, HTTP/3, SMPP, BGP, and Application Firewall.
• CVE-2026-120863 (score 8.7) in the management area, which requires access to NSIP or NSIP6 addresses.

Who is affected?

Impacted are all organizations that self-manage NetScaler ADC or NetScaler Gateway branch 14.1 and 13.1 appliances with builds below the patch version. The details:

• NetScaler is a VPN gateway or virtual application access for employees.
• NetScaler which is a load balancer in front of web applications and APIs.
• FIPS and NDcPP editions, which have their own fix build numbers.
• Hybrid Secure Private Access Deployment that uses a NetScaler instance.

Vendor-managed cloud services are updated by the vendor, so customers of those services do not need to update themselves.

How serious is CVE-2026-120868?

This loophole is categorized as critical with a score of 9.3, but the level of urgency is still below the loopholes that have been exploited because there have been no reports of attacks. Reasons to keep moving fast: NetScaler was repeatedly targeted after patches were released, and this loophole requires no login.

• 28 gaps in one bulletin: 9 critical, 15 high, and 4 moderate.
• CVE-2026-120868 has a score of 9.3 and applies in the default configuration.
• There have been no reports of exploitation, and no confirmed public proof of concept.
• No workarounds. Vendors only provide improvements via new builds.
• CERT-EU issued advisory 2026-020 and recommends an immediate update, with internet-facing Gateway and AAA appliances prioritized.

Which version is safe?

A safe version is the following build or later on the same branch:

How to check your NetScaler version?

The way to check is to run show ns version in the NetScaler CLI, then compare the build number with the table above. The output is shaped like NS14.1: Build 72.40.nc.

The following small script compares that output with minimal builds for the standard 14.1 and 13.1 branches. We have tested the script in the sandbox with several example build numbers. For FIPS and NDcPP editions, compare the manual with the table because the build numbers are different.

#!/bin/bash
# Pakai: ./cek_ns.sh "NS14.1: Build 72.40.nc"   (tempel keluaran `show ns version`)
v="$1"
rel=$(echo "$v" | grep -oE 'NS[0-9]+\.[0-9]+' | sed 's/NS//')
bld=$(echo "$v" | grep -oE 'Build [0-9]+\.[0-9]+' | sed 's/Build //')
case "$rel" in
  14.1) min=73.57 ;;
  13.1) min=64.39 ;;
  *) echo "Cabang $rel tidak ada di tabel buletin, cek manual"; exit 2 ;;
esac
if [ "$(printf '%s\n%s\n' "$min" "$bld" | sort -V | head -n1)" = "$min" ]; then
  echo "AMAN: $rel-$bld (minimal $rel-$min)"
else
  echo "PERLU UPDATE: $rel-$bld lebih lama dari $rel-$min"
fi

Example results: NS14.1: Build 72.40.nc produces PERLU UPDATE, while NS13.1: Build 64.39.nc produces AMAN.

How to update safely?

A safe way to update is to update internet-facing appliances first, one node at a time, with a configuration backup before starting.

Step 1: reduce exposure while waiting for the appointment

There is no official workaround for CVE-2026-120868, so this step only mitigates the risk of another vulnerability in the same bulletin:

• Make sure the NSIP and NSIP6 management addresses are not reachable from the internet or guest network.
• Note the active features (Gateway, AAA, SAML, HTTP/3, and others) to determine the order of priority.
• Prioritize Internet-facing Gateway and AAA appliances.

Step 2: update and verify

1. Save the running configuration with save ns config, then make a full backup from the Backup and Restore menu.
2. Download the branch-specific fix build from the vendor's download portal.
3. In high availability pairs, update the secondary node first, test it, do a failover, then update the previously primary node.
4. After rebooting, run show ns version and make sure the build matches the table.
5. Test the VPN login, primary virtual server, and HA sync before closing the maintenance window.

How to detect attack attempts?

There are no official indicators of compromise for this flaw, as the vendor states it is not aware of any exploits. What can be monitored are common symptoms of memory problems:

• Appliance restarting itself, HA failover for no apparent reason, or the appearance of a new core dump file.
• An unusual traffic spike to the server's virtual address immediately before the outage.
• Access to management addresses from unknown sources.

Crashes in builds that haven't been updated are not evidence of an attack, but are worth investigating and are a reason to speed up the update.

What if the appliance crashes repeatedly before it can update?

1. Save core dump and log files before they are deleted by rotation.
2. Note the time of the event and match it to the firewall logs in front of the appliance.
3. Advance the update schedule to the fix build.
4. Open a ticket to vendor support by attaching the file.

Frequently asked questions

Has CVE-2026-120868 been exploited?

There are no reports yet. The vendor stated it was not aware of any exploits, CERT-EU said there was no confirmed public proof of concept, and this loophole was not yet in the CISA KEV catalog as of November 13, 2026.

Does this loophole allow appliance takeover?

The vendor bulletin only mentions unexpected behavior or denial of service, and does not address remote code execution. Memory gaps still need to be treated seriously because impact assessments can change.

We only use NetScaler as a load balancer, without Gateway. Still affected?

Yes. CVE-2026-120868 applies to all deployments in the default configuration. What doesn't apply to you are Gateway and AAA specific vulnerabilities such as CVE-2026-107412.

Is there any workaround besides updating?

There isn't any. Bulletin CTX697305 does not list a workaround, so updating to a fix build is the only way.

What is the minimum build number that must be installed?

14.1-73.57 for branch 14.1, 13.1-64.39 for branch 13.1, 14.1-73.58 for 14.1-FIPS, and 13.1-37.293 for 13.1-FIPS and NDcPP.

Also read this week's discussion of other vulnerabilities: Apache CVE-2026-119618 in mod_http2, OpenSSH CVE-2026-123158 in Alpine, and Outlook CVE-2026-124194.

Source

• Citrix: security bulletin CTX697305 for NetScaler ADC and NetScaler Gateway
• CERT-EU: Security Advisory 2026-020
• Cyber ​​Security News: Citrix Patches 28 Security Vulnerabilities in NetScaler
• Rescana: Citrix NetScaler CVE-2026-120868 critical bulletin