SURIQ
Every customer-managed Citrix NetScaler ADC and NetScaler Gateway appliance needs another upgrade, and this time no configuration takes you out of scope. On November 12, 2026, Cloud Software Group published bulletin CTX697305 covering 28 memory-safety CVEs. One of them, CVE-2026-120868, lives in core packet processing and hits the default configuration. The fixed builds are 14.1-73.57 and 13.1-64.39, or 14.1-73.58 FIPS and 13.1-37.293 for the FIPS and NDcPP editions. Citrix reports no exploitation so far.
If you patched NetScaler in October, you are not finished. The October build that closed the last SAML memory overflow, 14.1-73.46, sits below the new floor. This is the fourth minimum-safe build for the 14.1 branch since late September.
Which NetScaler builds does CTX697305 affect?
NetScaler ADC and Gateway 14.1 builds before 14.1-73.57 and 13.1 builds before 13.1-64.39 are affected, as are FIPS builds before 14.1-73.58 FIPS and FIPS or NDcPP builds before 13.1-37.293. Secure Private Access Hybrid deployments that run on NetScaler instances are in scope too. Cloud Software Group upgrades its own managed cloud services.
To confirm what a box is running, show ns version from the NetScaler command line prints the build. The bulletin offers no workaround: upgrading is the only fix, and Citrix asks customers to do it as soon as possible. CERT-EU's advisory 2026-020 gives the same answer and says to start with internet-facing Gateway and AAA (authentication, authorization and auditing) appliances.
Why CVE-2026-120868 removes the usual triage step
Citrix bulletins carry a precondition column, and most NetScaler teams use it to decide which appliances can wait. A box with no load balancing for SMPP (the protocol behind bulk text messaging), no BGP dynamic routing and no HTTP/2 profile could usually sit out a large part of a bulletin like this one.
CVE-2026-120868 breaks that habit. The bulletin marks it as affecting every deployment, default configuration included, with no feature to switch on first. It scores CVSS 9.3 on version 4.0 of the scale: reachable over the network, no login, no user interaction. A load balancer that has never been near a VPN is just as exposed as your remote-access gateway.
The precondition column still matters for ordering. Gateway and AAA boxes collect the most findings. CVE-2026-107412, the highest score in the bulletin at 9.5, is a set of memory overflows that applies when the appliance acts as a Gateway (SSL VPN, ICA Proxy, clientless VPN or RDP Proxy) or an AAA virtual server. Around it sit separate overflows in the sign-in paths: SAML single sign-on (CVE-2026-107413), WebAuth (CVE-2026-107414), email one-time passcodes (CVE-2026-107415), LDAP, client certificates and Endpoint Analysis. A typical enterprise gateway with SAML and email codes configured matches at least five of the 28 at once.
Lines in the saved config that pull an appliance into scope
Grep the running or saved configuration for these entries to rank your fleet. They come straight from the bulletin's precondition checks. None of them changes the answer for CVE-2026-120868, which needs no matching line at all.
(any build below the fixed release) CVE-2026-120868 add vpn vserver CVE-2026-107412, CVE-2026-120864 add authentication vserver CVE-2026-107412, CVE-2026-120864 add authentication samlAction CVE-2026-107413 add authentication webAuthAction CVE-2026-107414 add authentication emailAction CVE-2026-107415 set ns httpProfile ... -http2 ENABLED CVE-2026-111346
The description says crash. The CVSS vector says more.
Every entry in CTX697305 describes its impact the same way: unpredictable behavior or denial of service (DoS), meaning the appliance stops serving traffic. The scores on the two headline bugs go further. The vectors for CVE-2026-120868 and CVE-2026-107412 rate confidentiality and integrity impact as high, not only availability. The SAML and WebAuth flaws, CVE-2026-107413 and CVE-2026-107414, score availability only. Citrix has not explained the difference in the bulletin.
Our read: plan for the two headline bugs as if they could be worse than a crash until Citrix says otherwise. The precedent is recent. Last month's CTX697191 described CVE-2026-107406, another NetScaler memory overflow, as a flaw that could let an attacker run code on the appliance, not only crash it.
Even a plain crash is expensive on this hardware. A NetScaler Gateway usually terminates the SSL VPN and brokers every remote login, so knocking it over locks out the remote workforce until it comes back. We made the same point about the SAML crash bug in October, and it applies to 28 flaws now, not one.
Your vulnerability scanner may undercount this bulletin
When we queried the CVE program's records a few hours after publication, several of the 28 IDs, including CVE-2026-107415 and CVE-2026-120864, did not yet return a published record. One ID in the bulletin currently resolves to a record for an unrelated product. Scanners and patch dashboards that match on CVE records may show fewer NetScaler findings than the bulletin lists for a while. Track this release by build number, not by CVE count.
Four safe NetScaler builds in seven weeks
| Bulletin | What it fixed | 14.1 build | 13.1 build |
|---|---|---|---|
| Late September 2026 | CVE-2026-88771 and CVE-2026-88772, exploited zero-days | 14.1-73.37 | 13.1-64.23 |
| October 3, 2026 | CVE-2026-88779, SAML denial of service | 14.1-73.41 | 13.1-64.28 |
| October 8, 2026 (CTX697191) | CVE-2026-107406, SAML memory overflow | 14.1-73.46 | 13.1-64.29 |
| November 12, 2026 (CTX697305) | 28 memory flaws incl. CVE-2026-120868 | 14.1-73.57 | 13.1-64.39 |
The 14.1 floor moved from 14.1-73.37 in late September, after the exploited zero-days we covered in our CVE-2026-88772 hunt guide, to 14.1-73.41 on October 3, to 14.1-73.46 on October 8, and now to 14.1-73.57. The 13.1 branch went from 13.1-64.23 to 13.1-64.28, 13.1-64.29 and now 13.1-64.39. Teams that treated each bulletin as a one-off emergency have upgraded the same appliances four times, and anyone who skipped one is now several builds behind.
The pace is unlikely to slow soon. Citrix credits researchers at JPMorgan Chase and watchTowr for this release, and says its own product security team found several of the bugs through AI-assisted code analysis. When a vendor starts pointing machine-assisted review at a large, long-lived code base, more memory bugs tend to surface in the following months. A standing monthly NetScaler upgrade window, rehearsed on a secondary node, will cost less than another round of emergency change tickets. If you track appliance builds as part of your vulnerability detection program, set the floor to the new builds today. Earlier NetScaler fixes we covered, such as the CVE-2026-19490 login bypass and the July HTTP/2 fix that needed a setting change, are all superseded by this release.
Get every appliance to 14.1-73.57 or 13.1-64.39
-
Inventory everything running NetScaler. Include high-availability secondaries, disaster-recovery pairs and Secure Private Access Hybrid instances. Record the build each one reports.
-
Upgrade internet-facing Gateway and AAA appliances first. They carry CVE-2026-107412 and most of the sign-in bugs on top of CVE-2026-120868.
-
Do not stop at the edge. Internal load balancers in their default configuration are still exposed to CVE-2026-120868.
-
Watch for crashes while you wait. Until a box is upgraded, alert on unexplained appliance restarts and high-availability failovers, the most visible sign of someone probing a memory bug.
-
Verify the result. After the upgrade, confirm the reported build is 14.1-73.57 or 13.1-64.39 or later, not just that the job finished.
CERT-EU says it knows of no confirmed public exploit code, and the bulletin mentions no attacks. That window is the reason to move this week rather than after the next NetScaler headline.