Citrix Patches 12 NetScaler ADC/Gateway/Console and Secure Access Client Flaws, Including Authentication Bypass (CVE-2026-120869)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5871 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NetScaler Console (CVE-2026-120869) Management Plane Access from Non-Admin Source — Exploitation

Detects successful HTTP requests to NetScaler Console management paths (NITRO, /mas, /admin_ui, /stylebook) from non-RFC1918 sources. CVE-2026-120869 (CTX697320, CVSS 9.4) is an unauthenticated improper-authentication flaw in NetScaler Console (fixed in 14.1-74.34); a bypass appears as successful management-plane requests from hosts that should never reach the Console. Behaviour-first hunt: no exploit signature is public and Citrix reports no known exploitation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078
• Data sources: netscaler_console_access_logs, citrix_cef_syslog, web_server
• Severity: high
• Confidence: medium

Splunk SPL

index=netscaler sourcetype=access_combined host=*console* earliest=-24h
| where status>=200 AND status<400
| where match(uri_path, "^/(nitro/v1|mas|admin_ui|stylebook)")
| where NOT (cidrmatch("10.0.0.0/8", clientip) OR cidrmatch("172.16.0.0/12", clientip) OR cidrmatch("192.168.0.0/16", clientip))
| stats count AS requests dc(uri_path) AS distinct_paths values(uri_path) AS paths min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where requests>=3
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table host clientip requests distinct_paths paths first_seen last_seen

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in~ ("Citrix", "Citrix Systems")
| where DeviceName has "console" or Computer has "console"
| where RequestURL matches regex @"(/nitro/v1|/mas/|/admin_ui|/stylebook)"
| where not(ipv4_is_private(SourceIP))
| summarize Requests=count(), DistinctUrls=dcount(RequestURL), Urls=make_set(RequestURL, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DeviceName
| where Requests >= 3
| project DeviceName, SourceIP, Requests, DistinctUrls, Urls, FirstSeen, LastSeen

Sigma

title: NetScaler Console Management Path Access from Non-Internal Source (CVE-2026-120869)
id: 7d1c4a52-3b0e-4f6a-9a1d-5e2b8c9f1a01
status: experimental
description: Detects HTTP access to NetScaler Console management paths from non-RFC1918 sources, the observable result of a CVE-2026-120869 authentication bypass.
references:
    - https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.120869
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|startswith:
            - '/nitro/v1'
            - '/mas/'
            - '/admin_ui'
            - '/stylebook'
        sc-status:
            - 200
            - 201
            - 204
            - 302
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Remote administrators connecting over VPN with public egress IPs
    - Authorized third-party MSP or vulnerability scanners
level: high

Known false positives:

• Remote admins or MSPs reaching the Console from public egress IPs
• Authorized vulnerability scanners probing management paths

Tuning notes: Replace the three RFC1918 CIDRs with your real admin/jump-host ranges (allowlist rather than denylist). Confirm the Console host naming (host=*console*) and the index/sourcetype of your Console access logs. Raise the requests threshold if scanners are noisy. Patch Console to 14.1-74.34+ and restrict the management interface to trusted admin networks.

• 🔒 NetScaler Gateway/AAA Authentication Failure Burst Followed by Success — External Remote Services · unlock with TL Creds
• 🔒 Citrix Secure Access Client for Linux (CVE-2026-118269) Root Shell Spawn — Post-Exploitation · unlock with TL Creds
• 🔒 NetScaler Vulnerable-Feature Configuration Change (SMPP, PUSH, Email OTP, DoH, ICA Proxy) — Exposure Surface · unlock with TL Creds
• 🔒 NetScaler EPA/DoH Endpoint Server-Error Burst — Memory Overflow Probing · unlock with TL Creds
• 🔒 NetScaler Local Admin Account or Command Policy Change — Post-Authentication-Bypass Persistence · unlock with TL Creds
• 🔒 NetScaler Appliance Shell Access via CLI — Post-Exploitation Hands-on-Keyboard · unlock with TL Creds
• 🔒 Citrix Secure Access Client for Windows (CVE-2026-118268) SYSTEM Shell Spawn — Post-Exploitation · unlock with TL Creds
• 🔒 NetScaler ADC/Gateway Packet Engine Crash or Restart (CVE-2026-120868 family) — Impact · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5871.

Technical analysis

Citrix states it is not aware of any exploits for the announced vulnerabilities.

On 2026-11-12 Citrix published security bulletins covering twelve vulnerabilities. Advisory CTX697305 covers nine NetScaler ADC and NetScaler Gateway memory-safety flaws: CVE-2026-120868 (memory overflow in packet processing, all ADC/Gateway deployments, CVSS 9.3), CVE-2026-107407 (SMPP traffic, requires an SMPP-type Load Balancing or Content Switching virtual server, 9.3), CVE-2026-107408 (DNS/DNS-over-HTTPS memory corruption, requires DNS load balancing with recursive resolution, 9.3), CVE-2026-107409 (DoH memory corruption, requires DNS load balancing over HTTPS, 9.3), CVE-2026-107410 (NetScaler Push overflow, requires a PUSH-type Load Balancing virtual server, 9.3), CVE-2026-107412 (multiple memory overflows, requires a Gateway or AAA virtual server, 9.5), CVE-2026-107415 (Email OTP authentication overflow, requires an Email Action, 9.3), CVE-2026-111344 (Endpoint Analysis EPA/EPAS overflow, requires a VPN or AAA virtual server using Endpoint Analysis, 9.3) and CVE-2026-120864 (ICA proxy overflow, requires a Gateway VPN, AAA or CR virtual server of type HDX, 9.3). The described impact for these is erratic behavior or denial of service.

CVE-2026-120869 (CTX697320) is an improper authentication flaw in NetScaler Console (CVSS 9.4) that lets an unauthenticated attacker bypass authentication controls; it is fixed in 14.1-74.34 and later. Because NetScaler Console is a centralized management plane for NetScaler fleets, an authentication bypass there is high-value for any actor who obtains network reach to it.

CVE-2026-118268 (Secure Access Client for Windows, CTX697280, fixed in 26.11.1.6) and CVE-2026-118269 (Secure Access Client for Linux, CTX697281, fixed in 26.10.4) are improper privilege management flaws (CVSS 8.5) allowing a low-privileged local user to gain SYSTEM or root respectively.

Fixed ADC/Gateway builds: 14.1-73.57 and later, 13.1-64.39 and later, 14.1-FIPS 14.1-73.58 and later, and 13.1-FIPS / 13.1-NDcPP 13.1-37.293 and later. Citrix says it is not aware of any exploits for these vulnerabilities and that the updates followed a deeper codebase review that integrated AI-assisted code analysis. No CWE identifiers, reporter credits, PoC code, attribution or IOCs were published in the available sources. Note: Citrix advisory pages (support.citrix.com) and the Citrix techzone blog could not be retrieved (JavaScript-rendered / HTTP 403), so details here rely on The Hacker News coverage of the bulletins. Earlier NetScaler flaws in 2026 (e.g. CVE-2026-19490, an authentication bypass disclosed 2026-08-19 and reported exploited from early September) are separate issues and are cited only as historical context for how quickly NetScaler flaws get targeted.

MITRE ATT&CK techniques by tactic:

Persistence

T1133 External Remote Services

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Credential Access

T1552.001 Unsecured Credentials

Remediation

Patches

• CTX697305 (NetScaler ADC and Gateway)
• CTX697320 (NetScaler Console)
• CTX697280 (Secure Access Client for Windows)
• CTX697281 (Secure Access Client for Linux)

Immediate actions

• Upgrade NetScaler ADC/Gateway to 14.1-73.57+, 13.1-64.39+, 14.1-FIPS 14.1-73.58+, or 13.1-FIPS/NDcPP 13.1-37.293+
• Upgrade NetScaler Console to 14.1-74.34 or later
• Update Citrix Secure Access Client for Windows to 26.11.1.6+ and for Linux to 26.10.4+
• Restrict network access to the NetScaler Console management interface to trusted admin networks

Workarounds

• No workarounds identified in available sources; disable unused vulnerable features (e.g. SMPP, PUSH, DoH, Email OTP virtual servers/actions) where not required

Longer-term hardening

• Inventory NetScaler appliances and identify those with SMPP, DNS/DoH, PUSH, Email OTP, Endpoint Analysis, ICA proxy (HDX) and Gateway/AAA virtual servers
• Monitor NetScaler appliances for unexpected crashes, core dumps and restarts
• Track Citrix bulletins and CISA KEV for exploitation status changes

Affected and fixed versions

• Citrix (Cloud Software Group) — NetScaler ADC
  Vulnerable versions: 14.1 before 14.1-73.57; 13.1 before 13.1-64.39; 14.1-FIPS before 14.1-73.58; 13.1-FIPS and 13.1-NDcPP before 13.1-37.293
  Fixed in: 14.1-73.57; 13.1-64.39; 14.1-73.58 FIPS; 13.1-37.293
• Citrix (Cloud Software Group) — NetScaler Gateway
  Vulnerable versions: 14.1 before 14.1-73.57; 13.1 before 13.1-64.39
  Fixed in: 14.1-73.57; 13.1-64.39
• Citrix (Cloud Software Group) — NetScaler Console
  Vulnerable versions: 14.1 before 14.1-74.34
  Fixed in: 14.1-74.34
• Citrix (Cloud Software Group) — Secure Access Client for Windows
  Vulnerable versions: before 26.11.1.6
  Fixed in: 26.11.1.6
• Citrix (Cloud Software Group) — Secure Access Client for Linux
  Vulnerable versions: before 26.10.4
  Fixed in: 26.10.4

Timeline

Last updated 2026-11-13 · revalidated 1× · latest source

• 2026-07-14 Context: earlier Citrix Secure Access Client for Windows local privilege escalation (CVE-2026-53565, CVSS 8.5) published; separate from this advisory set
• 2026-08-19 Context: the same Citrix bulletin (CTX696939) also disclosed unrelated NetScaler memory overflow CVE-2026-19489 (CVSS v4 8.8, unpredictable behavior/DoS), showing a recurring pattern of memory-safety flaws alongside authentication bypasses
• 2026-08-19 Context: Citrix disclosed unrelated NetScaler Gateway/AAA authentication bypass CVE-2026-19490 (CVSS v4 9.3)
• 2026-09-04 Context: reporting indicated threat actors targeting the earlier patched NetScaler authentication bypass CVE-2026-19490
• 2026-11-12 The Hacker News reported the update set; Citrix stated it is not aware of any exploits and cited an AI-assisted codebase review
• 2026-11-12 Citrix released fixes for 12 vulnerabilities across NetScaler ADC, Gateway, Console and Secure Access Client (CTX697305, CTX697320, CTX697280, CTX697281)
• 2026-11-12 CTX697280 and CTX697281 fixed local privilege escalation CVE-2026-118268 (Windows, 26.11.1.6) and CVE-2026-118269 (Linux, 26.10.4), CVSS 8.5
• 2026-11-12 CTX697320 fixed CVE-2026-120869 (CVSS 9.4), an unauthenticated improper-authentication flaw in NetScaler Console, in build 14.1-74.34 and later
• 2026-11-13 SecurityWeek reports the same Citrix release fixes 28 NetScaler ADC/Gateway vulnerabilities (nine critical, 19 mostly high/medium, incl. medium CVE-2026-111338 log-file credential exposure) plus the critical Console flaw CVE-2026-120869; Citrix does not mention exploitation in the wild.

Update history

• 2026-11-13 — Citrix Patches 10 Critical NetScaler Vulnerabilities (ADC, Gateway, Console) incl. CVE-2026-120869: What changed No severity, exploitability or status change. Scope clarified: the ADC/Gateway batch is reported as 28 flaws in total (9 critical + 19 others), not only the 12 originally listed.

Sources cited

• Citrix advisory CTX697305 - NetScaler ADC and Gateway support.citrix.com · Advisory · 2026-11-12
• Citrix advisory CTX697320 - NetScaler Console support.citrix.com · Advisory · 2026-11-12
• Citrix advisory CTX697280 - Secure Access Client for Windows support.citrix.com · Advisory · 2026-11-12
• Citrix advisory CTX697281 - Secure Access Client for Linux support.citrix.com · Advisory · 2026-11-12
• Citrix security updates blog for NetScaler ADC, NetScaler Gateway and NetScaler Console community.citrix.com · Vendor report · 2026-11-12
• The Hacker News - Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass The Hacker News · News · 2026-11-12
• Help Net Security - Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) [related prior flaw] Help Net Security · News · 2026-08-21

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Previous and next in vulnerability

• N-central 4EverAble2Shell and Agent2Shell exploits (root RCE and Windows SYSTEM) work against build 2026.4.1.26; exploitation attempts chained with CVE-2026-90436 Previous report
• ThreatsDay Roundup: Microsoft MDASH Linux Kernel Bugs (CVE-2026-64563), Falcon Browser Spyware, GSocket Backdoors Next report