# NetScaler Console: authentication bypass requires access to the console IP Canonical: https://www.oktsec.com/radar/citrix-netscaler-console-cve-2026-120869 Publisher: Oktsec Language: en Published: 2026-11-13T02:18:43Z Updated: 2026-11-13T02:18:43Z Record reviewed: 2026-11-13T02:18:43Z Latest evidence check: 2026-11-13T02:18:43Z Disclosed: 2026-11-12 Citrix identifies an authentication bypass in NetScaler Console 14.1 before 14.1-74.34. An attacker must be able to reach the console IP; the bulletin does not establish active exploitation. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Citrix provides a correction for access to restricted console resources without authentication. Access to the console IP is required, the CVSS vector specifies adjacent access, and attacks are not established. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Citrix - Products: NetScaler Console - CVEs: CVE-2026-120869 - Vendor severity: CVSS 4.0 9.4 ## Technical overview CVE-2026-120869 permits access to restricted resources on NetScaler Console without authentication. The attacker must be able to reach the Console IP, and Citrix’s CVSS vector specifies adjacent access. This evidence does not support describing every Console deployment as exposed to arbitrary Internet attackers. Citrix lists Console 14.1 before 14.1-74.34 as affected and urges installation of 14.1-74.34 or later. The November 12 bulletin does not establish active exploitation. Console is managed separately from ADC and Gateway, whose simultaneous bulletin lists different corrected builds. Oktsec recommends checking both inventories, restricting administrative reachability and reviewing unexpected access where relevant. ## Recommended response Update NetScaler Console 14.1 to 14.1-74.34 or later. Restrict access to the console IP and review unexpected administrative access; ADC and Gateway updates use different builds. Relevant to: Teams operating NetScaler Console 14.1. ## CVE attribution - CVE-2026-120869: Citrix — NetScaler Console; CVSS 4.0: 9.4. [Source](https://support.citrix.com/external/article/CTX697320/citrix-netscaler-console-security-bullet.html) ## Affected systems and fixes ### NetScaler Console 14.1 Affected: Before 14.1-74.34 Fixed release / action: 14.1-74.34 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-120869 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ## Response checklist 1. **Check Console separately from ADC and Gateway** — Identify NetScaler Console 14.1 instances and their builds. Determine which hosts can reach the console IP; the vendor’s CVSS vector specifies adjacent access. 2. **Install 14.1-74.34 or later** — Follow the Console upgrade procedure and verify the active build. The ADC/Gateway corrections in CTX697305 are not the Console correction. 3. **Restrict and review administrative access** — Oktsec recommends limiting console reachability to trusted administration paths and checking unexplained access to restricted resources. Investigate suspicious events; the vendor bulletin does not establish real attacks. ## Relevance to AI environments Oktsec recommends including this component in infrastructure inventories used by security automation; this vulnerability is not specific to AI. ## Sources - [CTX697320: NetScaler Console authentication bypass and correction](https://support.citrix.com/external/article/CTX697320/citrix-netscaler-console-security-bullet.html) — Citrix / Cloud Software Group; Vendor notice; checked 2026-11-13T02:13:46Z ## Editorial record - 2026-11-13T02:18:43Z: Added verified affected versions, branch corrections and the conditions described by the publisher. ## Related incidents - [NetScaler ADC and Gateway: critical fixes include the default configuration](https://www.oktsec.com/radar/citrix-netscaler-november-2026-security-update) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/citrix-netscaler-console-cve-2026-120869) · [Build a response plan](https://www.oktsec.com/radar/citrix-netscaler-console-cve-2026-120869#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=citrix-netscaler-console-cve-2026-120869&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=citrix-netscaler-console-cve-2026-120869&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.