Citrix has issued patches for 12 security flaws spanning NetScaler ADC, NetScaler Gateway, NetScaler Console and the NetScaler Secure Access Client, with the most severe — a 9.3-out-of-10 memory overflow — sitting alongside at least one authentication bypass.
The advisory covers three product families: NetScaler ADC, Citrix NetScaler Gateway and NetScaler Console, with the vendor stating the vulnerabilities can lead to denial-of-service conditions or authentication bypass. A separate set of flaws touches the NetScaler Secure Access Client.
The headline defect
The highest-scoring issue in the disclosed set is CVE-2026-120868, a memory overflow vulnerability carrying a CVSS score of 9.3. The vulnerable component and precise code path should be confirmed against Citrix's own bulletin before remediation scoping.
What makes the advisory urgent is the combination: a memory-safety bug of near-maximum severity sitting alongside an authentication bypass, in products that typically sit at the network edge. NetScaler ADC and Gateway deployments generally handle external traffic and remote access for the organisations running them, putting these defects within reach of the internet-facing side of an environment in at least some configurations. Administrators should confirm the affected builds, attack prerequisites and CVSS vectors against Citrix's primary advisory — including the CTX identifier and the complete CVE list — rather than working from secondary summaries.
What to prioritise
Patch ordering should follow the exposure profile of each product role:
- Internet-facing NetScaler ADC and Gateway instances — patch first. These are the systems an external attacker would target for both the overflow and any bypass.
- NetScaler Console — management-plane exposure is typically internal but high-impact if compromised, so it follows closely.
- NetScaler Secure Access Client — endpoint-side fixes can often be staged, though client updates still require a deployment plan.
Exploitation status
Check CISA's Known Exploited Vulnerabilities catalogue for any of the 12 issues, alongside Citrix's bulletin — a critical edge-facing flaw can move onto that list quickly once public.
Why it matters
NetScaler remains a widely deployed ADC and remote-access platform across enterprise networks, which makes this advisory broadly relevant to IT and security teams generally, including those running these products locally.
For teams in scope, the practical takeaway is straightforward: treat this as a same-week patching window for externally reachable NetScaler instances, verify the fixed builds against Citrix's advisory, and confirm whether any of the 12 issues appear in exploit-tracking feeds before finalising priorities.
Source: The Hacker News, November 2026. Full vulnerability details, affected versions and CVSS vectors are published in Citrix's own security bulletin.
Citrix 已發布補丁，修補涵蓋 NetScaler ADC、NetScaler Gateway、NetScaler Console 及 NetScaler Secure Access Client 的 12 項安全漏洞，其中最嚴重者為一項 9.3 分（滿分 10 分）的記憶體溢出漏洞，另有至少一項認證繞過（authentication bypass）漏洞。
是次安全通告涉及三個產品系列：NetScaler ADC、Citrix NetScaler Gateway 及 NetScaler Console，廠商指出相關漏洞可能導致拒絕服務（denial-of-service）情況或認證繞過。另一組漏洞則影響 NetScaler Secure Access Client。
最受關注的缺陷
已披露漏洞中評分最高的是 CVE-2026-120868，一項 CVSS 評分達 9.3 的記憶體溢出漏洞。制定修復範圍前，應向 Citrix 官方公告核實受影響的組件及確切的程式碼路徑。
是次通告之所以緊急，在於漏洞的組合：一項接近滿分嚴重程度的記憶體安全缺陷，與一項認證繞過漏洞並存，而相關產品通常部署於網絡邊緣。NetScaler ADC 及 Gateway 部署一般負責處理使用機構的外部流量及遙距存取，這意味在至少部分配置下，這些缺陷可從互聯網面向的一側接觸。系統管理員應向 Citrix 主要安全通告核實受影響的版本、攻擊前提條件及 CVSS 向量，包括 CTX 識別碼及完整 CVE 清單，而非依賴二手摘要。
優先處理次序
補丁部署次序應按各產品角色的暴露情況釐定：
- 面向互聯網的 NetScaler ADC 及 Gateway 實例——應優先修補。外部攻擊者針對溢出漏洞及任何繞過漏洞，均會以這些系統為目標。
- NetScaler Console——管理面（management plane）的暴露通常限於內部網絡，但一旦被入侵影響重大，故次之。
- NetScaler Secure Access Client——終端側的修補通常可以分階段部署，惟客戶端更新仍需制定部署計劃。
漏洞利用情況
可查閱 CISA 的已知被利用漏洞（Known Exploited Vulnerabilities）目錄，核對上述 12 項漏洞中是否有項目已獲收錄，同時亦應查閱 Citrix 的安全通告——面向網絡邊緣的嚴重漏洞一旦公開，可能很快被列入該名單。
為何重要
NetScaler 仍是企業網絡中廣泛部署的 ADC 及遙距存取平台，因此是次通告對一般 IT 及網絡安全團隊均具廣泛參考價值，包括本地部署這些產品的機構。
對於範圍內的團隊，實際的處理要點相當明確：將是次補丁視為本週內須完成的修補工作，適用於可從外部接觸的 NetScaler 實例；已修復版本應向 Citrix 官方通告核實；並在最終確定優先次序前，確認 12 項漏洞中有否任何一項已出現於漏洞利用追蹤情報源之中。
資料來源：The Hacker News，2026 年 11 月。完整的漏洞細節、受影響版本及 CVSS 向量，已於 Citrix 官方安全公告中刊出。