Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5968 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NetScaler NSIP Management Access From Non-Internal Source (CVE-2026-120863 Exposure)

Detects NetScaler management-plane activity (CLI/GUI logins and CMD_EXECUTED events) whose Remote_ip is outside private address space. CVE-2026-120863 (8.7) in CTX697305 is reachable via NSIP management addresses, and management access from the internet both exposes that flaw and enables lateral movement or reconfiguration of the appliance. A successful external management login also indicates use of a valid account (T1078), for example credentials harvested from httperror.log via CVE-2026-111338.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1133, T1210, T1078
• Data sources: citrix_netscaler_syslog (management login and CMD_EXECUTED events)
• Severity: high
• Confidence: medium

Splunk SPL

index=netscaler sourcetype="citrix:netscaler:syslog" earliest=-24h ("CMD_EXECUTED" OR "LOGIN") "Remote_ip" NOT "SSLVPN"
| rex field=_raw "Remote_ip\s+(?<remote_ip>\d{1,3}(?:\.\d{1,3}){3})"
| rex field=_raw "User\s+(?<user>\S+)"
| where isnotnull(remote_ip)
| where NOT (cidrmatch("10.0.0.0/8",remote_ip) OR cidrmatch("172.16.0.0/12",remote_ip) OR cidrmatch("192.168.0.0/16",remote_ip))
| stats count AS events values(user) AS users min(_time) AS first_seen max(_time) AS last_seen BY host remote_ip
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("CMD_EXECUTED", "LOGIN") and SyslogMessage has "Remote_ip" and SyslogMessage !has "SSLVPN"
| extend RemoteIp = extract(@"Remote_ip\s+(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage), User = extract(@"User\s+(\S+)", 1, SyslogMessage)
| where isnotempty(RemoteIp) and not(ipv4_is_private(RemoteIp))
| summarize Events = count(), Users = make_set(User, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, RemoteIp

Sigma

title: NetScaler Management Access From Non-Internal Address
id: 9e4a7c12-5d08-4b3f-a6e1-3f2c8d7b9a03
status: experimental
description: Detects NetScaler management login or command events from a non-private Remote_ip, indicating NSIP exposure relevant to CVE-2026-120863 (CTX697305) or unauthorized administrative access.
references:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1133
    - attack.lateral-movement
    - attack.t1210
    - attack.defense-evasion
    - attack.t1078
    - cve.2026-120863
logsource:
    product: citrix
    service: netscaler
detection:
    selection_event:
        - 'CMD_EXECUTED'
        - 'LOGIN'
    filter_internal:
        remote_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter_gateway:
        - 'SSLVPN'
    condition: selection_event and not filter_internal and not filter_gateway
falsepositives:
    - Admins arriving through a sanctioned public jump host
    - Vendor remote support
level: high

Known false positives:

• Administrators connecting over a public IP through a sanctioned jump host or VPN egress
• Remote support sessions from the vendor

Tuning notes: Replace the RFC1918 allow-list with your actual management network ranges and approved jump-host egress IPs. Any hit from an unexpected public address should be treated as an exposed NSIP and triaged immediately.

• 🔒 Single-Source Probing of NetScaler Gateway/AAA Endpoints After CTX697305 Disclosure · unlock with TL Creds
• 🔒 Access to [indicator] on NetScaler (CVE-2026-111338 Sensitive Login Data Exposure) · unlock with TL Creds
• 🔒 NetScaler BGP Neighbor Resets or Unknown Peer Activity (CVE-2026-120866) · unlock with TL Creds
• 🔒 NetScaler SAML/LDAP/RADIUS/OTP/EPA Authentication Anomaly Burst From Single Source · unlock with TL Creds
• 🔒 Credential Material Written to NetScaler httperror.log (CVE-2026-111338) · unlock with TL Creds
• 🔒 Internet-Sourced Traffic to NetScaler Feature Protocol Ports (SMPP, Diameter, MQTT, BGP) · unlock with TL Creds
• 🔒 NetScaler Packet Engine Crash, Core Dump or Restart (CVE-2026-120868 Packet Processing Memory Overflow) · unlock with TL Creds
• 🔒 NetScaler Gateway/AAA/SAML Configuration Change (add vpn vserver, add authentication samlAction) — CTX697305 Exposure Surface · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5968.

Technical analysis

Bulletin CTX697305 (published 2026-11-12) covers 28 CVEs in customer-managed NetScaler ADC and NetScaler Gateway: 9 Critical, 15 High and 4 Medium by the article's table (the article text says three Medium flaws rated 6.9, but its table lists four; all CVE IDs here are taken from the table). The highest score is CVE-2026-107412 (CVSS v4.0 9.5), which applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. CVE-2026-120868 (9.3) is a memory overflow in packet processing that affects default configurations and needs no login or user action. The other Critical flaws (CVE-2026-107407, -107408, -107409, -107410, -107415, -111334, -120864; all 9.3) are feature-dependent.

The source describes most of the flaws as memory-safety bugs (buffer overflows, out-of-bounds writes, double free) that matter only when the matching feature is configured. The article names, without mapping them to individual CVEs, these feature areas: for the 9.3 group, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP login, Endpoint Analysis and ICA proxy; for the 8.7 group, SAML, WebAuth, LDAP, client-certificate login, HTTP/3, GSLB, Diameter, MQTT and RADIUS handling. CVE-2026-120863 (8.7) is reachable via NSIP management addresses. CVE-2026-120866 (7.7) requires the attacker to be, or spoof, a configured BGP neighbor. CVE-2026-111338 (6.9) writes sensitive login data to /var/log/httperror.log, readable by anyone with local access to that file.

Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1 FIPS before 14.1-73.58 FIPS, and 13.1 FIPS and NDcPP before 13.1-37.293. Secure Private Access hybrid deployments that use NetScaler instances also require upgrades. Cloud Software Group says it is updating its managed cloud services and Adaptive Authentication. The source states no workaround is available; upgrading is required. For feature-dependent flaws, admins can check configurations for entries such as 'add vpn vserver' and 'add authentication samlAction'.

Exploitation, public PoC and IOCs are not stated in the source for this batch. Context: the source notes that Citrix fixed two other NetScaler zero-days in October 2026 and that CISA added one to KEV (the related KEV item CVE-2026-88779, added 2026-10-04, is a CWE-119 memory flaw with DoS impact per separate coverage); the article does not link them to this batch. It also notes that earlier NetScaler flaws were attacked quickly after patch release. Credits: JPMorgan Chase XOR team, Capital One Offensive Security, watchTowr, and the Citrix Product Security Team, which found several bugs using AI-assisted code analysis. The primary bulletin page could not be rendered when fetched (it returned only 'Loading...'), so per-CVE technical details above come from the Cyber Security News write-up; per-CVE vulnerability classes are largely unspecified. ATT&CK mappings reflect the exposure class (public-facing and remote-access services, memory-corruption/DoS, local credential exposure in logs), not observed adversary behavior.

MITRE ATT&CK techniques by tactic:

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1499.004 Application or System Exploitation

Credential Access

T1552.001 Credentials In Files

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

• Citrix Security Bulletin CTX697305 fixed builds: 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, 13.1-37.293 FIPS/NDcPP

Immediate actions

• Upgrade NetScaler ADC/Gateway to 14.1-73.57 or later, 13.1-64.39 or later, 14.1-73.58 FIPS or later, or 13.1-37.293 or later (FIPS and NDcPP)
• Prioritize internet-facing appliances because CVE-2026-120868 affects default configurations and needs no authentication
• Search running configuration for 'add vpn vserver' and 'add authentication samlAction' to identify feature-dependent exposure

Workarounds

• None available per source; upgrade is required

Longer-term hardening

• Restrict NSIP management addresses to trusted management networks (CVE-2026-120863 is reachable via NSIP)
• Restrict BGP sessions to authenticated, known neighbors (CVE-2026-120866)
• Monitor NetScaler appliances for unexpected crashes, restarts and configuration changes
• Restrict read access to /var/log/httperror.log and review it for sensitive login data (CVE-2026-111338)

Affected and fixed versions

• Cloud Software Group (Citrix) — NetScaler ADC and NetScaler Gateway 14.1
  Vulnerable versions: 14.1 before 14.1-73.57
  Fixed in: 14.1-73.57 and later
• Cloud Software Group (Citrix) — NetScaler ADC and NetScaler Gateway 13.1
  Vulnerable versions: 13.1 before 13.1-64.39
  Fixed in: 13.1-64.39 and later
• Cloud Software Group (Citrix) — NetScaler ADC 14.1 FIPS
  Vulnerable versions: 14.1 FIPS before 14.1-73.58 FIPS
  Fixed in: 14.1-73.58 FIPS and later
• Cloud Software Group (Citrix) — NetScaler ADC 13.1 FIPS and NDcPP
  Vulnerable versions: 13.1 FIPS and NDcPP before 13.1-37.293
  Fixed in: 13.1-37.293 and later
• Cloud Software Group (Citrix) — Secure Private Access hybrid deployments using NetScaler instances
  Vulnerable versions: Hybrid setups with unpatched NetScaler instances
  Fixed in: Upgrade the NetScaler instances to fixed builds

Timeline

• 2026-06-30 Citrix publishes bulletin CTX696604 fixing six NetScaler ADC/Gateway flaws (CVE-2026-8451, -8452, -8655, -10816, -10817, -13474), described as DoS and memory overflow issues with no evidence of exploitation at disclosure.
• 2026-10-04 CISA adds NetScaler vulnerability CVE-2026-88779 (CWE-119, DoS impact) to the KEV catalog after confirming active exploitation; the source does not link it to the CTX697305 batch.
• 2026-10-05 Cyber Security News reports the KEV addition; Citrix is reported to have fixed two exploited NetScaler zero-days in October 2026.
• 2026-10-07 Remediation deadline for US federal civilian agencies for the KEV-listed NetScaler flaw CVE-2026-88779.
• 2026-11-12 Cloud Software Group publishes CTX697305 fixing 28 NetScaler ADC and Gateway vulnerabilities (9 Critical, CVSS v4.0 9.3-9.5), including CVE-2026-120868 in default configurations; no workaround available.
• 2026-11-13 Cyber Security News publishes coverage of CTX697305; exploitation in the wild, public PoC and IOCs are not stated.

Sources cited

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-10-04
• Citrix NetScaler ADC and NetScaler Gateway Security Bulletin CTX697305 support.citrix.com · Vendor report · 2026-11-12
• NetScaler ADC and NetScaler Gateway Security Bulletin CTX696604 support.citrix.com · Vendor report · 2026-06-30
• Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations cybersecuritynews.com · News · 2026-11-13
• CISA adds Citrix NetScaler vulnerability (CVE-2026-88779) to KEV after active exploitation cybersecuritynews.com · News · 2026-10-05
• Citrix NetScaler vulnerabilities (CTX696604: DoS and memory overflow flaws) cybersecuritynews.com · News · 2026-07-01

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)
• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi

Other reports on CVE-2026-107412

• Citrix Patches 12 NetScaler ADC/Gateway/Console and Secure Access Client Flaws, Including Authentication Bypass (CVE-2026-120869)