Citrix Patches NetScaler Memory Flaws as One Critical Bug Affects Even Default Deployments

Citrix has released NetScaler security fixes that reach beyond appliances running optional features. One critical memory flaw affects even default deployments, leaving administrators with an upgrade decision regardless of how little they have switched on.

The November 12 release addresses 28 memory flaws in NetScaler ADC and Gateway, according to CERT-EU's advisory. CVE-2026-120868, rated 9.3 out of 10, affects core packet processing without requiring authentication or a special feature. The stated consequences include erratic behavior and denial of service.

The configuration is only part of the story

A second vulnerability, CVE-2026-107412, carries a 9.5 score and affects appliances acting as a Gateway or an authentication server. Other flaws depend on enabled features. CERT-EU recommends upgrading affected customer-managed appliances, with internet-facing Gateway and authentication systems first.

That is a broader task than checking whether one optional component is enabled. Citrix recommends upgrading even when the listed preconditions do not match, because the release includes additional security fixes.

An update with operational consequences

Citrix says its managed cloud services covered by the release have already received the updates. Customer-managed installations still need their own work. The company also warns that upgrading terminates existing ICA sessions, which users must start again afterward.

The evidence described here differs from the NetScaler zero-days Citrix confirmed were exploited in September. For this release, CERT-EU reports no confirmed public proof of concept, and Citrix says it is not aware of "unmitigated exploits" at the time of its announcement. Neither statement guarantees an appliance is safe to leave unpatched.

For operators, the immediate burden is scheduling an upgrade that may interrupt sessions while covering a flaw that default settings do not avoid.

Some offers on this page may be paid placements or contain affiliate links.