# NetScaler ADC and Gateway: critical fixes include the default configuration Canonical: https://www.oktsec.com/radar/citrix-netscaler-november-2026-security-update Publisher: Oktsec Language: en Published: 2026-11-13T02:18:43Z Updated: 2026-11-13T02:18:43Z Record reviewed: 2026-11-13T02:18:43Z Latest evidence check: 2026-11-13T02:18:43Z Disclosed: 2026-11-12 Citrix published corrections for 28 NetScaler vulnerabilities, including CVE-2026-120868 in the default configuration. Other flaws depend on enabled features or access conditions; the bulletin does not establish active exploitation. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: Citrix identifies critical flaws and branch corrections, including one affecting the default configuration. Other CVEs have distinct prerequisites; the reviewed bulletin does not establish attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Citrix - Products: NetScaler ADC, NetScaler Gateway - CVEs: CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107411, CVE-2026-107412, CVE-2026-107413, CVE-2026-107414, CVE-2026-107415, CVE-2026-111340, CVE-2026-111341, CVE-2026-111342, CVE-2026-111343, CVE-2026-111344, CVE-2026-111345, CVE-2026-111346, CVE-2026-111347, CVE-2026-111348, CVE-2026-111349, CVE-2026-120860, CVE-2026-120861, CVE-2026-120862, CVE-2026-120863, CVE-2026-120864, CVE-2026-120865, CVE-2026-120866, CVE-2026-120867 ## Technical overview Citrix’s November 12 bulletin groups 28 vulnerabilities affecting NetScaler ADC and Gateway. CVE-2026-120868 concerns packet processing in the default configuration and can cause erroneous behavior or denial of service. The bulletin does not establish active exploitation or demonstrate remote code execution. The remaining conditions differ. Examples include Gateway or AAA configuration, specific authentication actions, HTTP/2, QUIC, DNS, load balancing and routing features. CVE-2026-120863 requires access to the NSIP or NSIP6 management address. CVE-2026-111348 instead concerns authentication material written to a log and requires local read access after a logout. These are not interchangeable exposure conditions. Apply the correction for the exact standard, FIPS or NDcPP branch. Secure Private Access Hybrid deployments using NetScaler instances are included. This bulletin applies to appliances managed by customers; Cloud Software Group handles updates to its managed cloud services and Adaptive Authentication. Oktsec recommends reviewing management reachability and access to retained authentication logs alongside the upgrade. NetScaler Console has a separate bulletin and fixed build; upgrading ADC or Gateway does not establish that Console is corrected. ## Recommended response Update 14.1 to 14.1-73.57 or 13.1 to 13.1-64.39. Use 14.1-73.58 for FIPS or 13.1-37.293 for FIPS/NDcPP; check the separate NetScaler Console correction independently. Relevant to: Operators of NetScaler ADC and Gateway managed by customers, including instances used for Secure Private Access Hybrid. ## CVE attribution - CVE-2026-120868: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107407: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107408: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107409: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107410: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107411: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107412: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107413: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107414: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-107415: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111340: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111341: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111342: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111343: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111344: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111345: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111346: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111347: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111348: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-111349: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120860: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120861: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120862: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120863: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120864: Citrix — NetScaler ADC, NetScaler Gateway. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120865: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120866: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) - CVE-2026-120867: Citrix — NetScaler ADC. [Source](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) ## Affected systems and fixes ### NetScaler ADC and Gateway 14.1 Affected: Before 14.1-73.57 Fixed release / action: 14.1-73.57 or later ### NetScaler ADC and Gateway 13.1 Affected: Before 13.1-64.39 Fixed release / action: 13.1-64.39 or later in 13.1 ### NetScaler ADC 14.1 FIPS Affected: Before 14.1-73.58 FIPS Fixed release / action: 14.1-73.58 FIPS or later ### NetScaler ADC 13.1 FIPS/NDcPP Affected: Before 13.1-37.293 Fixed release / action: 13.1-37.293 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-111349](https://api.first.org/data/v1/epss?cve=CVE-2026-111349): 0.37% probability of observed exploitation in the next 30 days; percentile 31.85%; score date 2026-11-12. - [CVE-2026-111348](https://api.first.org/data/v1/epss?cve=CVE-2026-111348): 0.27% probability of observed exploitation in the next 30 days; percentile 19.97%; score date 2026-11-12. - [CVE-2026-111347](https://api.first.org/data/v1/epss?cve=CVE-2026-111347): 0.5% probability of observed exploitation in the next 30 days; percentile 43.13%; score date 2026-11-12. - [CVE-2026-111346](https://api.first.org/data/v1/epss?cve=CVE-2026-111346): 0.29% probability of observed exploitation in the next 30 days; percentile 22.23%; score date 2026-11-12. - [CVE-2026-111345](https://api.first.org/data/v1/epss?cve=CVE-2026-111345): 0.27% probability of observed exploitation in the next 30 days; percentile 19.3%; score date 2026-11-12. - [CVE-2026-111344](https://api.first.org/data/v1/epss?cve=CVE-2026-111344): 0.34% probability of observed exploitation in the next 30 days; percentile 27.64%; score date 2026-11-12. - [CVE-2026-111343](https://api.first.org/data/v1/epss?cve=CVE-2026-111343): 0.32% probability of observed exploitation in the next 30 days; percentile 24.79%; score date 2026-11-12. No score returned for: CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107411, CVE-2026-107412, CVE-2026-107413, CVE-2026-107414, CVE-2026-107415, CVE-2026-111340, CVE-2026-111341, CVE-2026-111342, CVE-2026-120860, CVE-2026-120861, CVE-2026-120862, CVE-2026-120863, CVE-2026-120864, CVE-2026-120865, CVE-2026-120866, CVE-2026-120867 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ## Response checklist 1. **Identify the branch and enabled features** — CVE-2026-120868 affects the default configuration. Match the other CVEs to Citrix’s prerequisite table, including Gateway/AAA, DNS, HTTP/2, QUIC, GSLB, authentication actions and routing features; do not treat all flaws as having the same access path. 2. **Install the correct standard or FIPS build** — Use 14.1-73.57 or 13.1-64.39 for standard ADC/Gateway branches, 14.1-73.58 for ADC FIPS, or 13.1-37.293 for ADC FIPS/NDcPP. Follow vendor upgrade instructions and verify each relevant appliance. 3. **Restrict management access** — CVE-2026-120863 requires access to NSIP or NSIP6. Oktsec recommends limiting management reachability to trusted administration paths; this does not replace the correction for other traffic paths. 4. **Assess authentication material in logs** — CVE-2026-111348 concerns authentication material in /var/log/httperror.log after a logout and requires local read access. Oktsec recommends restricting access to retained logs and investigating evidence of unauthorized reads before deciding which secrets or sessions need recovery. ## Relevance to AI environments Oktsec recommends including this component in infrastructure inventories used by security automation; this vulnerability is not specific to AI. ## Sources - [CTX697305: individual prerequisites and corrected NetScaler builds](https://support.citrix.com/external/article/CTX697305/citrix-netscaler-adc-and-citrix-netscale.html) — Citrix / Cloud Software Group; Vendor notice; checked 2026-11-13T02:13:46Z ## Editorial record - 2026-11-13T02:18:43Z: Added verified affected versions, branch corrections and the conditions described by the publisher. ## Related incidents - [NetScaler Console: authentication bypass requires access to the console IP](https://www.oktsec.com/radar/citrix-netscaler-console-cve-2026-120869) ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/citrix-netscaler-november-2026-security-update) · [Build a response plan](https://www.oktsec.com/radar/citrix-netscaler-november-2026-security-update#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=citrix-netscaler-november-2026-security-update&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=citrix-netscaler-november-2026-security-update&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.