CERT-EU says it affects every deployment, including appliances using the default configuration.CERT-EU gives the flaw a 9.3 CVSS score and says no authentication or special feature is required. The advisory describes the vendor's stated impact as unpredictable behavior and denial of service.
What it allows
How Does CVE-2026-120868 Affect NetScaler?
CERT-EU locates the overflow in the products' core packet processing. The advisory says an attacker does not need authentication or a special feature, and even a default configuration is affected.
That makes appliance exposure, rather than an optional feature setting, the key first check. For the exposure inventory step, see the external attack surface management platform. CERT-EU describes the possible outcome as unpredictable behavior or denial of service, matching the vendor bulletin it cites.
The opened advisory does not establish remote code execution or describe a confirmed intrusion. Do not transfer the effects of the other 27 NetScaler memory flaws in the same bulletin to this CVE.
What Is Known About Exploitation?
CERT-EU says Citrix reported an absence of exploitation as of its November 12, 2026 advisory. CISA KEV catalog version 2026.11.10 did not list CVE-2026-120868; that dated catalog status is not a broader exploitation finding.
Brandefense Blackhole counted two dark-chat posts matching CVE-2026-120868 from August 14 through November 12, 2026. These are discussion counts, not evidence that an appliance was exploited.
Citrix lists a separate management plane memory overflow that requires reachability to an appliance NSIP or NSIP6 address from an untrusted host. See the CVE-2026-120863 management plane profile for that distinct precondition and the fixed builds.Who is affected
Which NetScaler Releases Are Affected?
CERT-EU lists NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.57 and 13.1 before 13.1-64.39. It also lists NetScaler ADC FIPS before 14.1-73.58 FIPS and NetScaler ADC FIPS and NDcPP before 13.1-37.293.
The advisory says all deployments are affected, including default configurations. Inventory each appliance by product, branch, build and FIPS or NDcPP variant, then compare the installed build with the matching fixed release.
How Should Defenders Prioritize and Respond?
CERT-EU recommends upgrading all affected customer-managed appliances and prioritizing internet-facing Gateway and AAA appliances. Start with externally reachable systems that carry remote access or authentication traffic, then update the remaining affected ADC and Gateway fleet.
Install the matching fixed release or a later supported build in that branch. After maintenance, verify each appliance's running build and variant against the advisory, then confirm that expected Gateway and AAA services remain available.
As a Brandefense precaution, review monitoring for unexpected appliance restarts or service disruption around the disclosure period. These signs can have many causes and cannot alone establish exploitation of this CVE.
Use the vulnerability management guide to track remediation. The vulnerability prioritization glossary explains how to order fixes.
Timeline
- 2026-11-12
CERT-EU published advisory 2026-020, reporting Citrix's security bulletins and the fixed NetScaler releases.
What to do
-
Identify every affected appliance
List NetScaler ADC and Gateway appliances, their 14.1 or 13.1 branch, installed build, and any FIPS or NDcPP variant. Include default configurations.
-
Patch internet-facing systems first
Follow CERT-EU's priority for exposed Gateway and AAA appliances, then upgrade every remaining affected customer-managed appliance.
-
Verify the fixed build after maintenance
Check that the running build reaches 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS, or 13.1-37.293 as applicable. Confirm expected services remain available.
-
Review disruption telemetry
As a Brandefense precaution, examine unexpected restarts and service interruptions. Treat them as investigation leads, not proof of exploitation.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Does CVE-2026-120868 require a special NetScaler feature?
No. CERT-EU says the core packet-processing flaw affects all deployments, including default configurations, without a special feature or authentication.
Which NetScaler builds fix CVE-2026-120868?
CERT-EU lists 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 for their respective product branches and variants.
Does this advisory say CVE-2026-120868 enables code execution?
No. CERT-EU describes Citrix's stated impact as unpredictable behavior and denial of service; it does not establish code execution for this CVE.
Which NetScaler appliances should be upgraded first?
CERT-EU prioritizes internet-facing Gateway and AAA appliances, while recommending upgrades for all affected customer-managed ADC and Gateway appliances.
Sources
- Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler GatewayCERT-EU
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
