Critical9.3NetScaler (Citrix) Updated
CVE-2026-120869: unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
This NetScaler advisory covers CVE-2026-120869 in Console.
- CVE-2026-120869
Key facts
- Vendor rating
- Critical, CVSS 9.3
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L· base score 9.3, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: high. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: low. Availability impact on subsequent systems: low.- EPSS
- 0.51% chance of exploitation in the next 30 days (44th percentile). FIRST EPSS, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Console before 14.1-74.34
- Fixed in
- 14.1-74.34
- Advisory id
- CTX697320
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
NetScaler (Citrix)NetScaler Console
Description
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
Text from the source record.
Affected versions
- Console before 14.1-74.34
Official advisory · medium-confidence parse· fetched ·verify at source
How to fix CVE-2026-120869
Upgrade to the first fixed release for your version, shown in the table above.
Vendor guidance
- Upgrade to a fixed release: 14.1-74.34 or later.
End-of-life dates for NetScaler Console
More NetScaler (Citrix) advisories
CVE-2026-120867Nov 13, 2026Memory overflow in SSL/TLS/DTLSCVE-2026-120866Nov 13, 2026Memory overflow / improper handling in BGP dynamic routingCVE-2026-120865Nov 13, 2026Memory overflow in HTTP/3 (QUIC)CVE-2026-120864Nov 13, 2026Memory overflow in ICA proxyCVE-2026-120863Nov 13, 2026Memory overflow in the management planeCVE-2026-120862Nov 13, 2026Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths
NetScaler (Citrix) advisories, November 2026All NetScaler (Citrix) advisories
Get an email when NetScaler Console publishes the next one.
See NetScaler Console's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.