CVE-2026-120868: NetScaler Patch Triage

Citrix published a Critical security bulletin on November 12, 2026 for NetScaler ADC and NetScaler Gateway. Its first listed issue, CVE-2026-120868, is a memory overflow in packet processing. Citrix says the issue can cause unpredictable or erroneous behavior or denial of service, assigns it a CVSS v4.0 base score of 9.3, and includes all NetScaler ADC and Gateway deployments, including the default configuration.

The operational distinction is important: CVE-2026-120868 does not require a separate feature to be enabled. A feature inventory can help assess other CVEs in the same bulletin, but it is not a reason to mark this CVE out of scope.

Match the appliance to the fixed release line

Citrix lists the following fixed builds. Match the exact appliance edition before assigning an upgrade target; the FIPS and NDcPP suffixes are part of the version decision.

These are the bulletin’s minimum fixed thresholds, not a recommendation to remain on an old release. Select a currently supported target for the appliance and follow Citrix’s upgrade guidance for that deployment.

Triage the bulletin without missing the baseline issue

• Inventory every customer-managed ADC and Gateway appliance, including HA peers, disaster-recovery units, appliances outside the primary data center, and NetScaler instances used in Secure Private Access Hybrid.
• Record the edition and exact running build for each unit. Do not infer FIPS or NDcPP status from a neighboring appliance or its management label.
• Plan an upgrade for CVE-2026-120868 across the in-scope deployment. Its precondition is all ADC and Gateway deployments; no additional feature check is needed.
• Use the bulletin’s configuration checks to decide applicability for its other CVEs. Those checks answer different questions and must not be used to exempt an appliance from CVE-2026-120868.

Close remediation with per-appliance evidence

For each appliance, retain its identifier, edition, pre-upgrade build, approved target, change window, completion state, and post-change running version. In HA deployments, record both peers and the state after failover or restart; a successful update task alone does not prove that every active unit is running the fixed build. Complete a normal service-health check and retain any required configuration or traffic validation.

Citrix states that it upgrades Citrix-managed cloud services. Its bulletin separately says that customer-managed NetScaler instances in Secure Private Access Hybrid are affected and should be upgraded to the recommended builds. Keep those customer-managed appliances in the inventory.

The bulletin describes a memory-overflow issue and its possible service impact. It does not establish a reliable exploit, a confirmed code-execution outcome, or exploitation in the wild. Those claims should remain separate from the urgent patch decision unless an authoritative source updates the record.

The official Penligent 3.0 video below demonstrates a general AI-assisted testing workflow. It is not a reproduction of CVE-2026-120868 and does not verify a NetScaler patch.

Method: AI-assisted review of Citrix security bulletin CTX697305 on November 13, 2026. This article reports the vendor’s affected scope and fixed-version guidance; it does not claim an independent exploit test or product validation.

For broader patch prioritization, see our guide to CVE identifiers and vulnerability triage. To assess how AI-assisted testing fits an authorized validation program, review Penligent plans; keep the NetScaler upgrade and running-build evidence as a separate closure requirement.