Plan ahead Critical Patch available CVSS 9.3
Citrix patches NetScaler flaws, including authentication bypass and denial of service
The Hacker NewsCitrix, NetScalerCVE-2026-120868
What happened. Citrix has released patches for 12 flaws in NetScaler ADC, NetScaler Gateway and NetScaler Console. They could cause denial of service or an authentication bypass. One memory overflow flaw, CVE-2026-120868, is rated CVSS 9.3.
Who is affected. Users of NetScaler ADC, NetScaler Gateway and NetScaler Console. Industrial sites using Gateway for remote access are exposed, because vendors and engineers often reach plant systems through it.
What to do. Check whether you run NetScaler ADC, NetScaler Gateway or NetScaler Console, and apply the Citrix patches, starting with internet-facing gateways.
When to act. Plan ahead: Sites running NetScaler Gateway: a serious flaw with no stated exploitation; patch before or at the next maintenance…
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: NetScaler Gateway is a remote-access and perimeter product, and an authentication bypass there can open a path from the internet toward the industrial DMZ.
- Are you exposed?
Search your inventory for NetScaler ADC, Gateway and Console, and note which are internet-facing or used for remote access to plant systems.
- If you cannot fix it yet
- Limit which source addresses can reach the gateway and require multi-factor authentication for every remote-access user.
- Keep the gateway off the plant network until patched, with only the minimum routes into the industrial DMZ.
- Restrict access to the management interface to a small set of administration hosts.
- Watch for
- Successful logons to the gateway without a matching multi-factor or identity-provider event.
- Gateway crashes, restarts or unusual packet-processing errors that could signal exploitation attempts.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on CVE-2026-120868