2026-020: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and Gateway have 28 memory flaws, including a critical CVE-2026-120868 affecting all deployments.
Cloud Software Group has released security bulletins addressing 28 memory flaws in Citrix NetScaler ADC and NetScaler Gateway. One critical vulnerability, CVE-2026-120868, impacts all deployments, potentially causing unpredictable behavior and denial of service. While no exploitation has been reported, CERT-EU strongly advises upgrading affected appliances, prioritizing internet-facing ones.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCloud Software Group disclosed 28 memory-related vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, including a critical flaw (CVE-2026-120868) capable of causing denial of service and unpredictable system behavior across all deployment types. These products are widely used as internet-facing network gateways, making them high-value targets and elevating the urgency of remediation. The root issue lies in insufficient patch lifecycle management — organizations that delay upgrading appliances leave critical network infrastructure exposed, even before active exploitation is observed. CERT-EU's advisory underscores that internet-facing appliances must be treated as priority assets requiring expedited patching cycles.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-120868
- cve — CVE-2026-107412