Cybersecurity
Citrix NetScaler Critical Flaws: What Indian Firms Must Do
Affix Center · · 4 min read
In short: On 12 November 2026, Cloud Software Group published a critical security bulletin for Citrix NetScaler ADC and NetScaler Gateway covering 28 vulnerabilities. One flaw affects every deployment, including default setups. Indian companies and departments running these appliances for remote access or load balancing should upgrade to the fixed builds this week.
NetScaler appliances sit at the edge of many Indian networks. Banks, insurers, hospitals, IT services firms and government departments use them for SSL VPN, Citrix virtual app access and load balancing of public websites. Because they face the internet, flaws in them are a favourite target, and NetScaler bugs have been exploited soon after disclosure in the past. That makes this bulletin worth acting on quickly, even though no exploitation had been confirmed at release.
What Happened
According to the Citrix security bulletin CTX697305 dated 12 November 2026, the vendor fixed 28 vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. Most are memory overflow or memory corruption issues that can cause unpredictable behaviour or denial of service. The bulletin rates them as critical, with CVSS v4.0 scores from 6.9 to 9.5.
Two flaws stand out:
- CVE-2026-120868 (CVSS 9.3): a memory overflow in core packet processing. The bulletin says all NetScaler ADC and Gateway deployments are affected, including default configurations.
- CVE-2026-107412 (CVSS 9.5): multiple memory overflows affecting appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server.
The CERT-EU advisory 2026-020, published the same day, notes that Citrix reported no exploitation and no confirmed public proof-of-concept at the time. Security news reports, including SecurityOnline, say Citrix released four bulletins that day, which also cover an authentication bypass in NetScaler Console (CVE-2026-120869) and two local privilege escalation bugs in the Secure Access Client.
Who Is Affected
The bulletin lists these customer-managed versions as affected. Citrix-managed cloud services are updated by the vendor.
| Product line | Affected | Fixed build (or later) |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | Before 14.1-73.57 | 14.1-73.57 |
| NetScaler ADC and Gateway 13.1 | Before 13.1-64.39 | 13.1-64.39 |
| NetScaler ADC 14.1 FIPS | Before 14.1-73.58 FIPS | 14.1-73.58 FIPS |
| NetScaler ADC 13.1 FIPS and NDcPP | Before 13.1-37.293 | 13.1-37.293 |
The bulletin also says Secure Private Access hybrid deployments that use NetScaler instances are affected. If you run an older release line that is no longer supported, check with your vendor or partner, because it may not receive a fix at all.
What It Means for Indian Businesses and Departments
An appliance that handles VPN logins and public traffic is a single point of failure. A denial-of-service flaw can cut off remote staff, branch users or citizens trying to reach an online service. Memory corruption bugs can sometimes be turned into more serious attacks once researchers or attackers study the patch. Organisations that waited after earlier NetScaler bulletins, including the NetScaler zero-day we covered in October, learnt how short the window can be.
There is also a reporting angle. CERT-In's 2022 directions require many organisations in India to report specified cyber incidents within six hours of noticing them. If you find signs of compromise while patching, involve your security team early and check your obligations with your adviser.
What to Do Now
- Find every NetScaler appliance: list all ADC, Gateway, VPX and FIPS instances, including disaster recovery and test appliances, along with their current firmware build.
- Compare builds with the fixed versions: mark any appliance below 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 as vulnerable.
- Patch internet-facing Gateway and AAA appliances first: these are reachable without login for the two most severe flaws, so schedule an emergency change window for them before internal load balancers.
- Back up configuration before upgrading: save the running configuration and certificates, and confirm the HA pair upgrade order with your team or partner.
- Restrict access to management interfaces: make sure NetScaler Console and the management IP are reachable only from trusted admin hosts, not from the internet or the general office network.
- Check logs after patching: review authentication, crash and reboot logs for unusual activity around the disclosure date, and watch CISA's exploited vulnerabilities list for any of these CVEs being added.
- Update your patch process: record how long this upgrade took and add edge appliances to a faster patch track in your patch management process.
Frequently Asked Questions
Is this NetScaler flaw being exploited?
At release on 12 November 2026, CERT-EU and security news reports said Citrix had confirmed no exploitation and no public proof-of-concept. That can change quickly, so patch rather than wait.
Is there a workaround if we cannot patch today?
Reports on the bulletin say no workaround is listed. Limit exposure by restricting management access and plan the upgrade as an emergency change.
Do Citrix-hosted cloud services need action?
The bulletin says Citrix-managed cloud services are updated by Cloud Software Group. The action is for customer-managed appliances.
How Affix Center Can Help
Affix Center helps Indian companies and government departments keep edge devices patched and tested. We can help you inventory NetScaler and other remote access appliances, plan and run upgrades, review exposure and logs, and test your perimeter through our VAPT services in India. For ongoing protection and monitoring, see our cyber security services in India. To talk to our team, contact us.