[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSfS94k6lowK0xZSsQDWSh0XlkmhODzVU4DIQDMDvABE":3},{"article":4,"iocs":40,"watch_terms":48,"solutions":49,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"1273ffc6-0a1c-41a1-b8b8-f881a64c7140","2026-020: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway","2026-020-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway-224c81","On 12 November 2026, the Cloud Software Group published security bulletins for its Citrix products addressing 28 memory flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway. One of these vulnerabilities, CVE-2026-120868, affects every deployment, including those using the default configuration. The vendor bulletin describes the impact as unpredictable behaviour and denial of service. Citrix reports no exploitation, and no public proof-of-concept has been confirmed. CERT-EU strongly recommends upgrading all customer-managed NetScaler ADC and NetScaler Gateway appliances to the fixed releases. Internet-facing Gateway and AAA appliances should be upgraded first.","Cloud Software Group has released security bulletins addressing 28 memory flaws in Citrix NetScaler ADC and NetScaler Gateway. One critical vulnerability, CVE-2026-120868, impacts all deployments, potentially causing unpredictable behavior and denial of service. While no exploitation has been reported, CERT-EU strongly advises upgrading affected appliances, prioritizing internet-facing ones.","Citrix NetScaler ADC and Gateway have 28 memory flaws, including a critical CVE-2026-120868 affecting all deployments.","https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-020\u002F","https:\u002F\u002Fcert.europa.eu\u002Ffiles\u002Fimages\u002Fcerteu_home_share-v2.png","2026-11-12T17:20:53+00:00","2026-11-12T18:00:19.600156+00:00",9,[17,20,22,25],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":24},"Cloud Software Group","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41,45],{"type":42,"value":43,"context":44},"cve","CVE-2026-120868","Critical vulnerability affecting all deployments of Citrix NetScaler ADC and Gateway.",{"type":42,"value":46,"context":47},"CVE-2026-107412","Memory overflow vulnerability affecting appliances configured as Gateway or AAA virtual server.",[23,18,21],{"controls":50,"vendors":131},[51,80,102],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":81,"name":82,"problem":83,"products":84},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},{"slug":103,"name":104,"problem":105,"products":106},"patch-management","Automated patch management","Known holes get closed in days, not months.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[132],{"slug":133,"name":23,"logo_path":134,"roles":135},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":147},"critical-citrix-netscaler-flaws-demand-immediate-patching-of-internet-facing-appliances","Critical Citrix NetScaler Flaws Demand Immediate Patching of Internet-Facing Appliances","Cloud Software Group disclosed 28 memory-related vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, including a critical flaw (CVE-2026-120868) capable of causing denial of service and unpredictable system behavior across all deployment types. These products are widely used as internet-facing network gateways, making them high-value targets and elevating the urgency of remediation. The root issue lies in insufficient patch lifecycle management — organizations that delay upgrading appliances leave critical network infrastructure exposed, even before active exploitation is observed. CERT-EU's advisory underscores that internet-facing appliances must be treated as priority assets requiring expedited patching cycles.",[142,143,144,145,146],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks",{"NIS2 Article 21(2)(e)":148,"NIST SP 800-53 SI-2: Flaw Remediation":149,"CIS Control 7: Continuous Vulnerability Management (v8)":150,"CIS Control 2: Inventory and Control of Software Assets (v8)":151,"NIST CSF 2.0 RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks":152},"This point requires security in acquisition, development and maintenance including vulnerability handling, obligating operators of essential services to have processes for promptly addressing critical vulnerabilities in network infrastructure.","SI-2 requires organizations to identify, report, and correct information system flaws, directly mandating timely patching of critical vulnerabilities like those disclosed in NetScaler ADC and Gateway.","This control requires organizations to continuously assess and remediate vulnerabilities, which would have ensured the NetScaler flaws were identified and prioritized for patching before exploitation could occur.","Maintaining an accurate inventory of software versions across all appliances is prerequisite to knowing which NetScaler deployments are running vulnerable versions and need immediate upgrade.","This category directly addresses the need to act on newly disclosed vulnerabilities, supporting the prioritized upgrade of affected NetScaler appliances before exploitation occurs."]