# Citrix Patches 12 NetScaler ADC/Gateway/Console and Secure Access Client Flaws, Including Authentication Bypass (CVE-2026-120869)

> Citrix released fixes for 12 vulnerabilities across NetScaler ADC, NetScaler Gateway, NetScaler Console and Secure Access Client (Windows/Linux). Nine ADC/Gateway memory overflow/corruption flaws score CVSS 9.3-9.5 with denial-of-service impact, NetScaler Console has an unauthenticated authentication bypass (CVSS 9.4), and the Secure Access Client flaws allow local privilege escalation to SYSTEM/root (CVSS 8.5). Citrix states it is not aware of any exploits for the announced vulnerabilities.

- **Published:** 2026-11-12T16:36:49Z
- **Last reviewed:** 2026-11-13T09:44:08.101Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5871
- **ID:** TL-2026-5871
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107412, CVE-2026-107415, CVE-2026-111344, CVE-2026-120864, CVE-2026-120869, CVE-2026-118268, CVE-2026-118269, CVE-2026-19490, CVE-2026-111338

## Description

On 2026-11-12 Citrix published security bulletins covering twelve vulnerabilities. Advisory CTX697305 covers nine NetScaler ADC and NetScaler Gateway memory-safety flaws: CVE-2026-120868 (memory overflow in packet processing, all ADC/Gateway deployments, CVSS 9.3), CVE-2026-107407 (SMPP traffic, requires an SMPP-type Load Balancing or Content Switching virtual server, 9.3), CVE-2026-107408 (DNS/DNS-over-HTTPS memory corruption, requires DNS load balancing with recursive resolution, 9.3), CVE-2026-107409 (DoH memory corruption, requires DNS load balancing over HTTPS, 9.3), CVE-2026-107410 (NetScaler Push overflow, requires a PUSH-type Load Balancing virtual server, 9.3), CVE-2026-107412 (multiple memory overflows, requires a Gateway or AAA virtual server, 9.5), CVE-2026-107415 (Email OTP authentication overflow, requires an Email Action, 9.3), CVE-2026-111344 (Endpoint Analysis EPA/EPAS overflow, requires a VPN or AAA virtual server using Endpoint Analysis, 9.3) and CVE-2026-120864 (ICA proxy overflow, requires a Gateway VPN, AAA or CR virtual server of type HDX, 9.3). The described impact for these is erratic behavior or denial of service.

CVE-2026-120869 (CTX697320) is an improper authentication flaw in NetScaler Console (CVSS 9.4) that lets an unauthenticated attacker bypass authentication controls; it is fixed in 14.1-74.34 and later. Because NetScaler Console is a centralized management plane for NetScaler fleets, an authentication bypass there is high-value for any actor who obtains network reach to it.

CVE-2026-118268 (Secure Access Client for Windows, CTX697280, fixed in 26.11.1.6) and CVE-2026-118269 (Secure Access Client for Linux, CTX697281, fixed in 26.10.4) are improper privilege management flaws (CVSS 8.5) allowing a low-privileged local user to gain SYSTEM or root respectively.

Fixed ADC/Gateway builds: 14.1-73.57 and later, 13.1-64.39 and later, 14.1-FIPS 14.1-73.58 and later, and 13.1-FIPS / 13.1-NDcPP 13.1-37.293 and later. Citrix says it is not aware of any exploits for these vulnerabilities and that the updates followed a deeper codebase review that integrated AI-assisted code analysis. No CWE identifiers, reporter credits, PoC code, attribution or IOCs were published in the available sources. Note: Citrix advisory pages (support.citrix.com) and the Citrix techzone blog could not be retrieved (JavaScript-rendered / HTTP 403), so details here rely on The Hacker News coverage of the bulletins. Earlier NetScaler flaws in 2026 (e.g. CVE-2026-19490, an authentication bypass disclosed 2026-08-19 and reported exploited from early September) are separate issues and are cited only as historical context for how quickly NetScaler flaws get targeted.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1552.001 Unsecured Credentials

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NetScaler Console (CVE-2026-120869) Management Plane Access from Non-Admin Source — Exploitation** (`TL-2026-5871-SPL-001`)

Detects successful HTTP requests to NetScaler Console management paths (NITRO, /mas, /admin_ui, /stylebook) from non-RFC1918 sources. CVE-2026-120869 (CTX697320, CVSS 9.4) is an unauthenticated improper-authentication flaw in NetScaler Console (fixed in 14.1-74.34); a bypass appears as successful management-plane requests from hosts that should never reach the Console. Behaviour-first hunt: no exploit signature is public and Citrix reports no known exploitation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1078
- **Data sources:** netscaler_console_access_logs, citrix_cef_syslog, web_server
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=netscaler sourcetype=access_combined host=*console* earliest=-24h
| where status>=200 AND status<400
| where match(uri_path, "^/(nitro/v1|mas|admin_ui|stylebook)")
| where NOT (cidrmatch("10.0.0.0/8", clientip) OR cidrmatch("172.16.0.0/12", clientip) OR cidrmatch("192.168.0.0/16", clientip))
| stats count AS requests dc(uri_path) AS distinct_paths values(uri_path) AS paths min(_time) AS first_seen max(_time) AS last_seen BY clientip host
| where requests>=3
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table host clientip requests distinct_paths paths first_seen last_seen
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor in~ ("Citrix", "Citrix Systems")
| where DeviceName has "console" or Computer has "console"
| where RequestURL matches regex @"(/nitro/v1|/mas/|/admin_ui|/stylebook)"
| where not(ipv4_is_private(SourceIP))
| summarize Requests=count(), DistinctUrls=dcount(RequestURL), Urls=make_set(RequestURL, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DeviceName
| where Requests >= 3
| project DeviceName, SourceIP, Requests, DistinctUrls, Urls, FirstSeen, LastSeen
```

### Sigma

```yaml
title: NetScaler Console Management Path Access from Non-Internal Source (CVE-2026-120869)
id: 7d1c4a52-3b0e-4f6a-9a1d-5e2b8c9f1a01
status: experimental
description: Detects HTTP access to NetScaler Console management paths from non-RFC1918 sources, the observable result of a CVE-2026-120869 authentication bypass.
references:
    - https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.120869
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|startswith:
            - '/nitro/v1'
            - '/mas/'
            - '/admin_ui'
            - '/stylebook'
        sc-status:
            - 200
            - 201
            - 204
            - 302
    filter_internal:
        c-ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Remote administrators connecting over VPN with public egress IPs
    - Authorized third-party MSP or vulnerability scanners
level: high

```

**Known false positives:**

- Remote admins or MSPs reaching the Console from public egress IPs
- Authorized vulnerability scanners probing management paths

**Tuning notes:** Replace the three RFC1918 CIDRs with your real admin/jump-host ranges (allowlist rather than denylist). Confirm the Console host naming (host=*console*) and the index/sourcetype of your Console access logs. Raise the requests threshold if scanners are noisy. Patch Console to 14.1-74.34+ and restrict the management interface to trusted admin networks.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NetScaler Gateway/AAA Authentication Failure Burst Followed by Success — External Remote Services (locked: unlock with TL Creds)
- Citrix Secure Access Client for Linux (CVE-2026-118269) Root Shell Spawn — Post-Exploitation (locked: unlock with TL Creds)
- NetScaler Vulnerable-Feature Configuration Change (SMPP, PUSH, Email OTP, DoH, ICA Proxy) — Exposure Surface (locked: unlock with TL Creds)
- NetScaler EPA/DoH Endpoint Server-Error Burst — Memory Overflow Probing (locked: unlock with TL Creds)
- NetScaler Local Admin Account or Command Policy Change — Post-Authentication-Bypass Persistence (locked: unlock with TL Creds)
- NetScaler Appliance Shell Access via CLI — Post-Exploitation Hands-on-Keyboard (locked: unlock with TL Creds)
- Citrix Secure Access Client for Windows (CVE-2026-118268) SYSTEM Shell Spawn — Post-Exploitation (locked: unlock with TL Creds)
- NetScaler ADC/Gateway Packet Engine Crash or Restart (CVE-2026-120868 family) — Impact (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Hacker News - Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass](https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html)
- [Citrix advisory CTX697305 - NetScaler ADC and Gateway](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305)
- [Citrix advisory CTX697320 - NetScaler Console](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320)
- [Citrix advisory CTX697280 - Secure Access Client for Windows](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697280)
- [Citrix advisory CTX697281 - Secure Access Client for Linux](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697281)
- [Citrix security updates blog for NetScaler ADC, NetScaler Gateway and NetScaler Console](https://community.citrix.com/techzone-blogs/110_security-updates/security-updates-for-netscaler-adc-netscaler-gateway-and-netscaler-console/)
- [Help Net Security - Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) related prior flaw](https://www.helpnetsecurity.com/2026-08-21/citrix-netscaler-gateway-cve-2026-19490/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5871