Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

Citrix has patched 12 flaws across NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client, including nine critical memory-overflow issues in NetScaler, scored as high as 9.5, that can cause denial of service, and a critical improper-authentication flaw in NetScaler Console (CVE-2026-120869, CVSS 9.4) that lets an unauthenticated attacker bypass authentication. Citrix says the issues were found through AI-assisted code review and that it is not aware of any exploitation.