# Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations

> Cloud Software Group (Citrix) published bulletin CTX697305 on 2026-11-12 fixing 28 vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, nine of them Critical (CVSS v4.0 9.3-9.5). CVE-2026-120868, a memory overflow in packet processing, affects default configurations with no authentication or user interaction required; no workaround exists and exploitation in the wild is not stated in the source.

- **Published:** 2026-11-13T14:34:34Z
- **Last reviewed:** 2026-11-13T14:34:34Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5968
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5968.png
- **ID:** TL-2026-5968
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-107412, CVE-2026-120868, CVE-2026-107407, CVE-2026-107408, CVE-2026-107409, CVE-2026-107410, CVE-2026-107415, CVE-2026-111334, CVE-2026-120864, CVE-2026-107411, CVE-2026-107413, CVE-2026-107414, CVE-2026-111340, CVE-2026-111341, CVE-2026-111342, CVE-2026-111337, CVE-2026-120860, CVE-2026-120861, CVE-2026-120862, CVE-2026-120863, CVE-2026-120865, CVE-2026-120867, CVE-2026-111336, CVE-2026-120866, CVE-2026-111333, CVE-2026-111335, CVE-2026-111338, CVE-2026-111339, CVE-2026-88779

## Description

Bulletin CTX697305 (published 2026-11-12) covers 28 CVEs in customer-managed NetScaler ADC and NetScaler Gateway: 9 Critical, 15 High and 4 Medium by the article's table (the article text says three Medium flaws rated 6.9, but its table lists four; all CVE IDs here are taken from the table). The highest score is CVE-2026-107412 (CVSS v4.0 9.5), which applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. CVE-2026-120868 (9.3) is a memory overflow in packet processing that affects default configurations and needs no login or user action. The other Critical flaws (CVE-2026-107407, -107408, -107409, -107410, -107415, -111334, -120864; all 9.3) are feature-dependent.

The source describes most of the flaws as memory-safety bugs (buffer overflows, out-of-bounds writes, double free) that matter only when the matching feature is configured. The article names, without mapping them to individual CVEs, these feature areas: for the 9.3 group, SMPP traffic, DNS and DNS-over-HTTPS, NetScaler Push, Email OTP login, Endpoint Analysis and ICA proxy; for the 8.7 group, SAML, WebAuth, LDAP, client-certificate login, HTTP/3, GSLB, Diameter, MQTT and RADIUS handling. CVE-2026-120863 (8.7) is reachable via NSIP management addresses. CVE-2026-120866 (7.7) requires the attacker to be, or spoof, a configured BGP neighbor. CVE-2026-111338 (6.9) writes sensitive login data to /var/log/httperror.log, readable by anyone with local access to that file.

Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.57, 13.1 before 13.1-64.39, 14.1 FIPS before 14.1-73.58 FIPS, and 13.1 FIPS and NDcPP before 13.1-37.293. Secure Private Access hybrid deployments that use NetScaler instances also require upgrades. Cloud Software Group says it is updating its managed cloud services and Adaptive Authentication. The source states no workaround is available; upgrading is required. For feature-dependent flaws, admins can check configurations for entries such as 'add vpn vserver' and 'add authentication samlAction'.

Exploitation, public PoC and IOCs are not stated in the source for this batch. Context: the source notes that Citrix fixed two other NetScaler zero-days in October 2026 and that CISA added one to KEV (the related KEV item CVE-2026-88779, added 2026-10-04, is a CWE-119 memory flaw with DoS impact per separate coverage); the article does not link them to this batch. It also notes that earlier NetScaler flaws were attacked quickly after patch release. Credits: JPMorgan Chase XOR team, Capital One Offensive Security, watchTowr, and the Citrix Product Security Team, which found several bugs using AI-assisted code analysis. The primary bulletin page could not be rendered when fetched (it returned only 'Loading...'), so per-CVE technical details above come from the Cyber Security News write-up; per-CVE vulnerability classes are largely unspecified. ATT&CK mappings reflect the exposure class (public-facing and remote-access services, memory-corruption/DoS, local credential exposure in logs), not observed adversary behavior.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1552.001 Credentials In Files
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NetScaler NSIP Management Access From Non-Internal Source (CVE-2026-120863 Exposure)** (`TL-2026-5968-SPL-003`)

Detects NetScaler management-plane activity (CLI/GUI logins and CMD_EXECUTED events) whose Remote_ip is outside private address space. CVE-2026-120863 (8.7) in CTX697305 is reachable via NSIP management addresses, and management access from the internet both exposes that flaw and enables lateral movement or reconfiguration of the appliance. A successful external management login also indicates use of a valid account (T1078), for example credentials harvested from httperror.log via CVE-2026-111338.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1133, T1210, T1078
- **Data sources:** citrix_netscaler_syslog (management login and CMD_EXECUTED events)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=netscaler sourcetype="citrix:netscaler:syslog" earliest=-24h ("CMD_EXECUTED" OR "LOGIN") "Remote_ip" NOT "SSLVPN"
| rex field=_raw "Remote_ip\s+(?<remote_ip>\d{1,3}(?:\.\d{1,3}){3})"
| rex field=_raw "User\s+(?<user>\S+)"
| where isnotnull(remote_ip)
| where NOT (cidrmatch("10.0.0.0/8",remote_ip) OR cidrmatch("172.16.0.0/12",remote_ip) OR cidrmatch("192.168.0.0/16",remote_ip))
| stats count AS events values(user) AS users min(_time) AS first_seen max(_time) AS last_seen BY host remote_ip
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("CMD_EXECUTED", "LOGIN") and SyslogMessage has "Remote_ip" and SyslogMessage !has "SSLVPN"
| extend RemoteIp = extract(@"Remote_ip\s+(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage), User = extract(@"User\s+(\S+)", 1, SyslogMessage)
| where isnotempty(RemoteIp) and not(ipv4_is_private(RemoteIp))
| summarize Events = count(), Users = make_set(User, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, RemoteIp
```

### Sigma

```yaml
title: NetScaler Management Access From Non-Internal Address
id: 9e4a7c12-5d08-4b3f-a6e1-3f2c8d7b9a03
status: experimental
description: Detects NetScaler management login or command events from a non-private Remote_ip, indicating NSIP exposure relevant to CVE-2026-120863 (CTX697305) or unauthorized administrative access.
references:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.initial-access
    - attack.t1133
    - attack.lateral-movement
    - attack.t1210
    - attack.defense-evasion
    - attack.t1078
    - cve.2026-120863
logsource:
    product: citrix
    service: netscaler
detection:
    selection_event:
        - 'CMD_EXECUTED'
        - 'LOGIN'
    filter_internal:
        remote_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    filter_gateway:
        - 'SSLVPN'
    condition: selection_event and not filter_internal and not filter_gateway
falsepositives:
    - Admins arriving through a sanctioned public jump host
    - Vendor remote support
level: high

```

**Known false positives:**

- Administrators connecting over a public IP through a sanctioned jump host or VPN egress
- Remote support sessions from the vendor

**Tuning notes:** Replace the RFC1918 allow-list with your actual management network ranges and approved jump-host egress IPs. Any hit from an unexpected public address should be treated as an exposed NSIP and triaged immediately.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Single-Source Probing of NetScaler Gateway/AAA Endpoints After CTX697305 Disclosure (locked: unlock with TL Creds)
- Access to [indicator] on NetScaler (CVE-2026-111338 Sensitive Login Data Exposure) (locked: unlock with TL Creds)
- NetScaler BGP Neighbor Resets or Unknown Peer Activity (CVE-2026-120866) (locked: unlock with TL Creds)
- NetScaler SAML/LDAP/RADIUS/OTP/EPA Authentication Anomaly Burst From Single Source (locked: unlock with TL Creds)
- Credential Material Written to NetScaler httperror.log (CVE-2026-111338) (locked: unlock with TL Creds)
- Internet-Sourced Traffic to NetScaler Feature Protocol Ports (SMPP, Diameter, MQTT, BGP) (locked: unlock with TL Creds)
- NetScaler Packet Engine Crash, Core Dump or Restart (CVE-2026-120868 Packet Processing Memory Overflow) (locked: unlock with TL Creds)
- NetScaler Gateway/AAA/SAML Configuration Change (add vpn vserver, add authentication samlAction) — CTX697305 Exposure Surface (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations](https://cybersecuritynews.com/citrix-patches-netscaler-security-vulnerabilities/)
- [Citrix NetScaler ADC and NetScaler Gateway Security Bulletin CTX697305](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305&articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin)
- [CISA adds Citrix NetScaler vulnerability (CVE-2026-88779) to KEV after active exploitation](https://cybersecuritynews.com/cisa-citrix-netscaler-vulnerability-exploited/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Citrix NetScaler vulnerabilities (CTX696604: DoS and memory overflow flaws)](https://cybersecuritynews.com/citrix-netscaler-vulnerabilities/)
- [NetScaler ADC and NetScaler Gateway Security Bulletin CTX696604](https://support.citrix.com/external/article/696604)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5968