Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities identified below

What Customers Should Do

Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.57 and later releases
• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.39 and later releases of 13.1
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.58 FIPS and later releases of 14.1-FIPS
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later releases of 13.1-FIPS and 13.1-NDcPP

Steps to determine if a NetScaler deployment meets the CVE preconditions

CVE-2026-120868
Precondition: All NetScaler ADC and NetScaler Gateway deployments (Default configuration / No additional feature required)
Instructions: All NetScaler ADC and NetScaler Gateway deployments are affected, including those deployed with the default configuration. No additional features or settings need to be enabled for the NetScaler deployment to be vulnerable.

CVE-2026-107407
Precondition: NetScaler ADC is configured with a Load Balancing (LB) or Content Switching (CS) virtual server of type SMPP.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following patterns:

• add lb vserver .* SMPP
• add cs vserver .* SMPP

CVE-2026-107408
Precondition: NetScaler ADC is configured for DNS load balancing and recursive DNS resolution.
Instructions: Customers can determine if the appliance meets the preconditions by inspecting their NetScaler configuration for the following entries:

Recursive resolution configuration:

• set dns parameter -recursion ENABLED
• add dns profile <name> -recursiveResolution ENABLED

DNS proxy configuration:

• add lb vserver <name> DNS <ip> <port>
• add lb vserver <name> DNS_TCP <ip> <port>
• add lb vserver <name> DOT <ip> <port>
• add lb vserver <name> SSL <ip> <port> -dnsOverHttps ENABLED
• add cs vserver <name> DNS <ip> <port>
• add cs vserver <name> DNS_TCP <ip> <port>
• add cs vserver <name> DOT <ip> <port>
• add cs vserver <name> SSL <ip> <port> -dnsOverHttps ENABLED

CVE-2026-107409
Precondition: NetScaler is configured with DNS loadbalancing over HTTPS (DOH).
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following patterns:

• add lb vserver <name> SSL <ip> <port> -dnsoOverHttps ENABLED
• add cs vserver <name> SSL <ip> <port> -dnsOverHttps ENABLED

CVE-2026-107410
Precondition: NetScaler is configured as Load Balancing (LB) virtual server  of type PUSH
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration as shown below:

• add lb vserver <name> PUSH <IP> <Port>

CVE-2026-107411
Precondition: NetScaler ADC is configured with a Load Balancing (LB) virtual server of type RTSP or have RTSP ALG enabled on an LSN group.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following patterns:

• add lb vserver <n> RTSP <VIP> 554
• add lsn group <group name> -clientname <client name> -rtspalg ENABLED

CVE-2026-107412
Precondition: NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following:

Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy): 

• add vpn vserver .*

AAA virtual server: 

• add authentication vserver .*

CVE-2026-107413
Precondition: NetScaler ADC or NetScaler Gateway is configured with a SAML action
Instructions: Instructions:
Customers can determine whether their NetScaler deployment is configured as a SAML service provider (SP) by checking its configuration for entries matching the following:

• add authentication samlAction

CVE-2026-107414
Precondition: NetScaler ADC or NetScaler Gateway is configured with a WebAuth action.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching the following pattern:

• add authentication webAuthAction .*

CVE-2026-107415
Precondition: NetScaler ADC or NetScaler Gateway is configured with an Email Action.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching the following pattern:

• add authentication emailAction .*

CVE-2026-111340
Precondition: NetScaler ADC or NetScaler Gateway is configured as either an LDAP action with KBAttribute configured or configured with an Email action.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching either of the following:

• add authentication ldapAction .* -KBAttribute .*
• add authentication emailAction .*

CVE-2026-111341
Precondition: NetScaler ADC or NetScaler Gateway must be configured with a certification authentication action (CertAction)
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for entries matching the following pattern:

• add authentication certAction .*

CVE-2026-111342
Precondition: NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
Instructions: Customers can determine whether their NetScaler deployment meets the precondition by inspecting their NetScaler configuration for entries matching either of the following:

Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy):

• add vpn vserver .*

AAA virtual server:

• add authentication vserver .*

CVE-2026-111343
Precondition: NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server
Instructions: Customers can determine whether their NetScaler deployment meets the precondition by inspecting their NetScaler configuration for entries matching either of the following:

Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy):

• add vpn vserver .*

AAA virtual server:

• add authentication vserver .*

CVE-2026-111344
Precondition: The NetScaler appliance is configured as a VPN virtual server or an authentication (AAA) virtual server with Endpoint Analysis (EPA).
Instructions: Customers can determine whether their NetScaler deployment meets the precondition by inspecting their NetScaler configuration for entries matching either of the following:

• add authentication epaAction .*
• add aaa preauthenticationpolicy .*
• clientSecurity is configured in vpn parameter
• clientSecurity is configured in vpn sessionAction

CVE-2026-111346
Precondition: Any HTTP/SSL type virtual server  with HTTP/2 enabled in the associated HTTP profile
Instructions: Profile Check: Identify if -http2 ENABLED is set on any HTTP profile. If none are found, the appliance is considered non-vulnerable.
vServer Association: If such a profile exists, identify all LB, CS, and VPN vServers that reference it.
Default Profile Handling: If the default profile nshttp_default_profile has -http2 enabled, identify all vServers that utilize this default profile. (i.e., those without an explicit -httpProfileName assignment).

CVE-2026-111347
Precondition: A policy containing the B64DECODE operator must be bound globally or to a virtual server of any type, and/or an Application Firewall (AppFW) must be configured
Instructions: Check for any policy expression with B64DECODE bound to any vserver
Example: HTTP.REQ.BODY(10000).B64DECODE
grep only for B64DECODE in the ns.conf, and if found, NetScaler is vulnerable

CVE-2026-111349
Precondition: AppFW profile with affected protections (XML protection, multipart form-data, content-type inference, request-body signature or API Security/gRPC/OpenAPI spec)
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the following entries:

• add appfw profile .* -apispec .* -grpcAction .* -signatures .* -postBodyLimitSignature .* -(XMLDoSAction|XMLFormatAction|XMLValidationAction|XMLWSIAction|XMLSQLInjectionAction|XMLXSSAction|XMLAttachmentAction|XMLSOAPFaultAction) .* -(fieldConsistencyAction|inferContentTypeXMLPayloadAction|SQLInjectionAction|fieldConsistencyAction|fieldFormatAction|startURLAction) .* -(excludeFileUploadFromChecks|sessionlessURLClosure|startURLClosure)

CVE-2026-120860
Precondition: NetScaler ADC must be configured as a Load Balancing (LB) virtual server of type DIAMETER, SIP_TCP, MQTT, or RADIUS.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for any of the following entries:

• add lb vserver <name> DIAMETER <IP> <Port>
• add lb vserver <name> SIP_TCP <IP> <Port>
• add lb vserver <name> MQTT <IP> <Port>
• add lb vserver <name>  RADIUS <IP> <Port>

CVE-2026-120861
Precondition: The NetScaler appliance must have any of the following configured: a GSLB site with Metric Exchange Protocol (MEP) enabled, GSLB static proximity, a geolocation responder policy, or GSLB automatic configuration synchronization.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for any of the following entries:

• add gslb site -metricExchange ENABLED
• set gslb parameter -automaticConfigSync ENABLED
• add gslb vserver <name> <type> -lbmethod STATICPROXIMITY
• add responder policy <name> "CLIENT.IP.SRC.MATCHES_LOCATION(<location label>)" <action>

CVE-2026-120862
Precondition: The NetScaler appliance must have SIP ALG enabled on an LSN group OR DNS answer-section security logging enabled in a DNS profile.
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for either of the following entries:

     
SIP ALG enabled on an LSN group:

• add lsn group <groupname> -clientname <clientname> -sipalg ENABLED

DNS answer-section security logging enabled in a DNS profile: 

• add dns profile <profname> -dnsanswerSecLogging enABLED
• set dns profile default-dns-profile -dnsanswerSecLogging enABLED

CVE-2026-120864
Precondition: The appliance must be configured as a Gateway vpn virtual server or an AAA virtual server or CR virtual server of type HDX
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for any of the following entries:

• add vpn vserver <vserver-name>
• add authentication vserver <vserver-name>
• add cr vserver <vserver-name> HDX 

CVE-2026-120865
Precondition: The NetScaler appliance must be configured as a Load Balancing (LB) or Content Switching (CS) virtual server of type HTTP_QUIC
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for either of the following entries:

• add lb vserver <vserver-name> HTTP_QUIC
• add cs vserver <vserver-name> HTTP_QUIC

CVE-2026-120866
Precondition: BGP dynamic routing must be enabled with a configured neighbor and without TCP-MD5 authentication for that neighbor. The attacker must be, or be able to spoof, the configured neighbor.
Instructions: Check whether BGP is enabled and has a neighbor configured:
 1. show ns feature -> BGP is ON
 2. show router dynamicRouting -> output contains 'router bgp <ASN>' with at least one 'neighbor <IP> remote-as <ASN>'
 If BGP is OFF or no neighbor is configured, the appliance is not vulnerable.

CVE-2026-120867
Precondition: 1.TLS 1.3 vserver with ECH profile configured
 2.TLS1.3 vserver on Intel QAT (Coleto) Platforms with ECH profile configured
 3. SSL vserver with SafeNet HSM Key bound
Instructions: Customers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for either of the following entries:

• set ssl parameter -defaultProfile ENABLED
• set ssl profile <profile-name> -tls13 ENABLED -SNIEnable ENABLED -encryptedClientHello ENABLED
• set ssl vserver <vserver-name> -sslprofile <profile-name>
• add hsmKey <hsm-key> -hsmType SAFENET -serialNum <serial-no> -password <pass-word>
• add ssl certKey <certkey-name> -cert <cert-file> -hsmKey <hsm-key>
• bind ssl vserver <vserver-name> -certkeyName <certkey-name>

Severity - Critical

Description of Problem

Multiple vulnerabilities have been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.

Affected Versions

The following supported versions of Citrix NetScaler ADC and Citrix NetScaler Gateway are affected by the vulnerabilities: 
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.57
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.39
Citrix NetScaler ADC FIPS BEFORE 14.1-73.58 FIPS
Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.293

Additional Note: Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities. 
This bulletin only applies to customer-managed Citrix NetScaler ADC (“NetScaler ADC”) and Citrix NetScaler Gateway (“NetScaler Gateway”). Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.

Acknowledgement

Cloud Software Group acknowledges Michael Tucker, Chew Keong Tan of the XOR team at JPMorgan Chase, Himanshu Anand (@anand_himanshu) of watchTowr, and Sina Kheirkhah (SinSinology) of watchTowr, for working with us to protect our customers.

In addition, the Cloud Software Group Product Security Team identified several vulnerabilities through advanced AI-assisted code analysis.

What Citrix is Doing

Citrix is notifying customers and channel partners about this potential security issue through the publication of this security bulletin on the Citrix Knowledge Center at https://support.citrix.com/support-home/topic-article-list?trendingCategory=20&trendingTopicName=Security%20Bulletin

Obtaining Support on This Issue

If you require technical assistance with this issue, please contact Citrix Technical Support. Contact details for Citrix Technical Support are available at https://support.citrix.com/support-home/home 

Subscribe to Receive Alerts

Citrix strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified at https://support.citrix.com/wolken-support/view/aboutsupport/my-support-alerts  

Reporting Security Vulnerabilities to Citrix

Citrix welcomes input regarding the security of its products and considers any and all potential vulnerabilities seriously. For details on our vulnerability response process and guidance on how to report security-related issues to Citrix, please see the following webpage: https://www.cloud.com/trust-center/support 

Changelog