Critical 1 vendor · 1 advisory
CVE-2026-120869: An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
CVE-2026-120869 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- Critical
- CVSS base score
- 9.3 (NetScaler)
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L· base score 9.3, scored by NetScalerAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: none. User interaction: none. Confidentiality impact on the vulnerable system: high. Integrity impact on the vulnerable system: high. Availability impact on the vulnerable system: high. Confidentiality impact on subsequent systems: low. Integrity impact on subsequent systems: low. Availability impact on subsequent systems: low.- EPSS
- 0.51% chance of exploitation in the next 30 days (44th percentile). FIRST EPSS, .
- Fixed releases
- NetScaler: 14.1-74.34
- Vendor advisories
- 1 from NetScaler
- Assigned by
- NetScaler (CNA)
- CVE record published
- Listed by VulniPulse
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-120869; each belongs to its advisory, not to every product listed. How records are collected and checked.
Description
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
Text from the CVE.org record (NetScaler).
How do I fix CVE-2026-120869?
Upgrade to a fixed release named by the vendor:
- NetScaler: 14.1-74.34
- Upgrade to a fixed release: 14.1-74.34 or later. (NetScaler)
Vendor advisories for CVE-2026-120869
NetScaler
1 advisory- Advisory severityCritical9.3
Critical [CVE-2026-120869] unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
CTX697320Source published Source updated
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Affected products in this advisory
- Console
- Source-reported affected versions
- Console before 14.1-74.34
- Source-reported fixed versions
- 14.1-74.34
- Mitigation guidance
- Upgrade to a fixed release: 14.1-74.34 or later.
References
Timeline
- CVE record published
- First vendor advisory listed by VulniPulse
More NetScaler advisories
CVE-2026-120867Nov 13, 2026Memory overflow in SSL/TLS/DTLSCVE-2026-120866Nov 13, 2026Memory overflow / improper handling in BGP dynamic routingCVE-2026-120865Nov 13, 2026Memory overflow in HTTP/3 (QUIC)CVE-2026-120864Nov 13, 2026Memory overflow in ICA proxyCVE-2026-120863Nov 13, 2026Memory overflow in the management planeCVE-2026-120862Nov 13, 2026Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths
Get an email when NetScaler publishes the next one.
See NetScaler's last 90 days first. Live alerts for one product are free for life; every vendor is US$15 a month after a free month.