Citrix NetScaler ADC · Disclosed

[Single source] Citrix patches 12 flaws across NetScaler products

Nov 12, 2026 · 1 min read

Citrix released patches for 12 flaws in NetScaler ADC, NetScaler Gateway, NetScaler Console, and Secure Access Client. The vulnerabilities include critical issues that can cause denial of service or bypass authentication; administrators should install the available updates.

By HIFY Radar newsroom Updated 11/12/2026 01:12 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In 30 seconds

Alleged

Citrix has reportedly released patches for 12 security flaws across NetScaler and Secure Access Client products. The headline issue is a critical NetScaler Console authentication bypass rated 9.4 that could allow unauthenticated access to restricted resources. A separate NetScaler flaw could cause denial of service.

What happened

Alleged

The Hacker News reports that Citrix issued fixes for vulnerabilities affecting NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client. The reported consequences include authentication bypass and denial of service, which can make a service unavailable.

Why it matters

Alleged

The Console flaw matters because the report says an attacker would not need to authenticate before reaching restricted resources. The denial-of-service issues present a different risk: disruption rather than unauthorized access.

What to do

Inferred

Administrators should identify deployments of the named Citrix products and apply the available patches. The supplied evidence does not include affected-version tables or upgrade instructions, so those details should be checked against Citrix's applicable update documentation before deployment.

Confirmed and still uncertain

Observed

The supplied records identify a 12-flaw patch set, a critical Console authentication bypass and NetScaler denial-of-service risks. They do not provide the complete vulnerability list, affected versions, exploitation status, mitigations or evidence that attackers are using these flaws in the wild.

What people are saying

Alleged

The Hacker News emphasized the authentication bypass in its social post, describing it as a 9.4-severity NetScaler Console issue that could expose restricted resources to unauthenticated attackers. It also highlighted a separate NetScaler denial-of-service flaw rated 9.5.

Evolution

Observed

The RSS report introduced the broader patch release and named denial of service and authentication bypass as the main consequences. A follow-up post published shortly afterward sharpened the picture by assigning a 9.4 score to the Console bypass and mentioning a separate 9.5 denial-of-service flaw.

Reach

Observed

1 independent groups, 2 updates, and 9 engagements.

Technical detail

Observed

The RSS excerpt identifies CVE-2026-120868 as a memory-overflow vulnerability affecting NetScaler ADC and Gateway and gives it a 9.3 score. Separately, the social post reports a 9.4 Console authentication bypass and an unnamed 9.5 NetScaler denial-of-service flaw. The supplied material is insufficient to determine whether the scoring difference concerns distinct vulnerabilities or another detail absent from the excerpt.

Sources and evidence

Observed

This account rests on an article excerpt from The Hacker News and a related post from the publication's X account. Both records belong to the same story group, and the article body is truncated, so they provide one publisher's reporting rather than independent corroboration or the complete Citrix advisory.