Citrix NetScaler: Ten Critical Fixes for Plant Remote Access Gateways

Citrix released fixes on 12 November 2026 for 28 vulnerabilities in NetScaler ADC and NetScaler Gateway, nine of them rated critical, plus a separate critical flaw in NetScaler Console, the central management tool for NetScaler appliances. NetScaler Gateway is one of the most common ways that engineers, integrators and vendors reach plant systems from outside, so these appliances deserve attention at industrial sites. Citrix says none of these flaws is known to be exploited yet, but NetScaler has been a favorite target of attackers for years, including the CitrixBleed attacks of 2023, and the time between a patch and the first attacks keeps getting shorter. The Canadian Centre for Cyber Security also published an alert on the release (AV26-1150).

The flaw that affects every appliance

CVE-2026-120868 is a memory overflow in NetScaler packet processing, rated 9.3 on the Common Vulnerability Scoring System (CVSS). A memory overflow means the software writes data past the space set aside for it, which can crash the device or make it behave in ways it should not. Citrix says this one affects every NetScaler ADC and NetScaler Gateway, including appliances running the default configuration with no extra features turned on, and it needs no login. Citrix describes the outcome as unpredictable behavior or a denial of service, meaning the appliance stops passing traffic.

The flaws that matter most for remote access

Several of the critical flaws sit in the features that remote access gateways depend on. CVE-2026-107412, the highest score in the release at 9.5, covers multiple memory overflows that apply when the appliance runs as a Gateway (SSL virtual private network (VPN), ICA proxy, clientless VPN or Remote Desktop Protocol (RDP) proxy) or as an authentication server. CVE-2026-111334 (9.3) affects Endpoint Analysis, the check that inspects a remote computer before letting it connect. CVE-2026-107415 (9.3) affects email one-time passcode sign-in, and CVE-2026-120864 (9.3) affects the ICA proxy, which carries Citrix virtual desktop sessions. The remaining critical flaws, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409 and CVE-2026-107410, apply only when specific load balancing or DNS features are configured. Among the lower-rated fixes, CVE-2026-111338 writes sensitive sign-in material into a log file, and CVE-2026-120863 can disrupt the appliance through its management address, which is one more reason to keep that address off the internet.

NetScaler Console: authentication bypass

CVE-2026-120869, rated 9.4, lets an attacker with no login who can reach the NetScaler Console address get past its sign-in and reach restricted parts of the system. Console is the place where administrators manage and push configuration to many NetScaler appliances at once, so a compromise there can reach every gateway it manages. All NetScaler Console 14.1 releases before 14.1-74.34 are affected.

Fixed versions

For NetScaler ADC and NetScaler Gateway, Citrix lists 14.1-73.57 and later, 13.1-64.39 and later, 14.1-73.58 FIPS and later, and 13.1-37.293 and later for the 13.1 FIPS and NDcPP builds (the certified builds used by government and regulated customers). NetScaler Console should be on 14.1-74.34 or later. The Canadian alert also lists updates for the Secure Access Client for Linux (26.10.4) and Windows (26.11.16).

Where this shows up, plant floor to cloud

At many utilities, refineries, chemical plants and manufacturers, a NetScaler Gateway in the business demilitarized zone (DMZ), the buffer network between the internet and internal systems, is the front door for remote engineering work. A contractor signs in through the gateway, lands on a jump server, and from there reaches historians, engineering workstations and human-machine interface (HMI) screens at Level 3 and below. The same appliances often front virtual desktops that operators use from the office. If the gateway goes down, remote support for the plant stops. If it is ever turned into a way in, it is the path straight toward the control network. NetScaler Console usually sits in the corporate data center or in the cloud and holds the configuration for all of these gateways.

What to do now

1. Find every NetScaler ADC, NetScaler Gateway and NetScaler Console you own, including any that an integrator, vendor or managed service provider runs for remote access to your plants, and compare their versions with Citrix bulletins CTX697305 and CTX697320.
2. Patch the appliances that face the internet and handle remote access first, then the internal ones. Upgrade NetScaler Console to 14.1-74.34 or later, and plan to replace any appliance on a release that Citrix no longer supports.
3. Keep the NetScaler management address and the Console address reachable only from an administrator network, never from the internet or the business network at large.
4. After patching, review the gateway's sign-in logs and active sessions for unfamiliar accounts or connections, rotate any credentials that may have been written to the httperror.log file, and confirm that remote users still land on a jump server rather than going straight into the control network.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Citrix NetScaler ADC and NetScaler Gateway Security Bulletin CTX697305, 12 November 2026: https://support.citrix.com/external/article/CTX697305 ; Citrix NetScaler Console Security Bulletin CTX697320: https://support.citrix.com/external/article/CTX697320 ; Canadian Centre for Cyber Security AV26-1150: https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-1150