# Citrix NetScaler Console CVE-2026-120869 (CTX697320): detection pack

**Pack version 1.0.1 (12 Nov 2026).** Citrix NetScaler Console has an unauthenticated authentication bypass,
CVE-2026-120869, published in security bulletin CTX697320. Citrix rates it Critical. NetScaler's 14.1 documentation
says: "Starting from 14.1-17.x build, NetScaler ADM is rebranded to NetScaler Console". The bulletin itself does not
mention the ADM name.

> **Patch now, whatever the hunts show.** Citrix "strongly urges affected customers of Citrix NetScaler Console to
> install the relevant updated versions as soon as possible": 14.1-74.34 and later releases.
>
> **Status of this pack.** The KQL in this pack has NOT been run against a live tenant. Neither has the converted
> Sigma in `sigma/converted/`. Test and tune them before you rely on them. Citrix published no indicators of
> compromise, so every hunt and rule here is OUR PATTERN: our own hunting ideas, not Citrix guidance. Items that no
> Citrix or NetScaler source confirms are marked [UNVERIFIED].

## Vendor facts (all times GMT, 12 Nov 2026)

| Item | Value | Source (fetched) |
|---|---|---|
| Bulletin | "Citrix NetScaler Console Security Bulletin for CVE-2026-120869", article CTX697320. Changelog: "2026-11-12 Initial Publication". The "Updated On" field is blank on the public page | Citrix bulletin (15:06) |
| Description | "An unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance" (bulletin). The CVE record ends "... on the Citrix NetScaler Console appliance" | Bulletin; cve.org (15:04) |
| Pre-condition | "Access to Citrix NetScaler Console IP" | Bulletin |
| CWE | CWE-287 Improper Authentication (bulletin). The CVE record carries no CWE | Bulletin; cve.org |
| Severity | Bulletin: "Severity - Critical". CVE record: CNA base severity CRITICAL | Bulletin; cve.org |
| Bulletin score | CVSS v4.0 Base Score 9.4, `CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H` | Bulletin |
| CVE record score | NetScaler CNA: CVSS v4.0 9.3, `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L` | cve.org; NVD shows the same vector as Secondary (CNA) |
| Affected | Bulletin: "Citrix NetScaler Console 14.1 BEFORE 14.1-74.34" ("The following supported versions ... are affected"). CVE record: product "Console", vendor "Citrix NetScaler", version 0 less than 14.1-74.34 (versionType "patch"), default status unaffected | Bulletin; cve.org |
| Fix | "Citrix NetScaler Console 14.1-74.34 and later releases". Citrix's download page lists "NetScaler Console Release (Maintenance Phase) 14.1 Build 74.34", dated Nov 12, 2026 | Bulletin; citrix.com downloads (15:08) |
| Workaround | The bulletin gives none and does not mention one | Bulletin |
| Credit | "Discovered by the Cloud Software Group Product Security Team using advanced AI-assisted analysis" | Bulletin |
| CVE dates | Public 13:57 (datePublic); record published 14:03 by the NetScaler CNA | cve.org |
| NVD | Published 14:17, status "Received"; only the CNA's 9.3 score, shown as Secondary | NVD API (15:04) |
| CISA KEV | Not listed. Latest catalogue 2026.11.10, released 10 Nov 2026 19:03, before the CVE was public | CISA KEV JSON feed (15:04) |
| Exploitation | The bulletin says nothing about exploitation. A web search at 15:20 GMT on 12 Nov 2026 found no public proof of concept for this CVE. We make no claim either way about exploitation | Bulletin; web search |

**Both scores, not reconciled.** The bulletin gives 9.4 with an Adjacent attack vector and High subsequent system
impacts. The CVE record from the NetScaler CNA gives 9.3 with a Network attack vector and Low subsequent system
impacts. Both say Critical. We report both as published.

**Branches and other offerings (exactly what the sources say):**

* The bulletin lists only "Citrix NetScaler Console 14.1 BEFORE 14.1-74.34". It does not mention 13.1, the NetScaler
  Console service (cloud), Console agents, NetScaler ADC or NetScaler Gateway. We do not call any of them in or out of
  scope.
* The CVE record's range is "0" to before "14.1-74.34" for product "Console", with no branch named. We do not read it as
  covering or excluding 13.1.
* Citrix's download page still offers NetScaler Console 13.1 maintenance builds (latest listed: 13.1 Build 62.27,
  Mar 25, 2026). The bulletin says nothing about 13.1, so the checkers report 13.1 as NOT LISTED, not as affected or
  safe. Ask Citrix if you run it.

## What to do

**Citrix's advice (from CTX697320):** install NetScaler Console 14.1-74.34 or a later release "as soon as possible".
Citrix also "strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is
created or modified". The bulletin gives no workaround and no detection guidance.

**OUR ADVICE (CybaVerse, not from Citrix):**

1. Inventory every NetScaler Console (and anything still called ADM) you or your clients run, with its build. Use the
   CSV checker below. Include HA pairs and DR nodes.
2. Patch to 14.1-74.34 or later now, regardless of what the hunts find.
3. Restrict the Console management IP to your admin network or VPN. The bulletin's pre-condition is network access to
   the Console IP, so every other source is attack surface.
4. Confirm the Console is not internet-facing (KQL Q2b, Sigma firewall rule). Fix it if it is.
5. Reactive, for any Console that was reachable from outside your admin network while on a build below 14.1-74.34:
   * review Console audit and syslog from at least 30 days back (KQL Q3 to Q5, checker `--log`);
   * review Console admin users, groups and roles for anything new or changed;
   * look for unexplained configuration jobs pushed to managed NetScaler ADC and Gateway instances (KQL Q5, Q5b);
   * if the Console was exposed and unpatched, rotate the credentials it stores: instance profiles for managed
     ADC and Gateway (such as nsroot), and any other stored credentials and profiles.
6. Subscribe to Citrix security bulletin alerts.

## Caveats

* The KQL in this pack has NOT been run against a live tenant.
* KEV dates are for US federal agencies only (BOD 26-04, issued 10 Jun 2026, which CISA says supersedes and revokes the 2021 KEV directive). Not being in KEV is not a statement about exploitation.
* Patch now regardless of hunt results. A clean hunt is not proof the appliance was not accessed.
* Log formats: the message bodies we use come from NetScaler's syslog references (below). How they arrive in your
  SIEM (Sentinel `Syslog` columns, any CEF mapping) is [UNVERIFIED]. The wording of commands inside `Command "..."`
  is [UNVERIFIED]; NetScaler documents the message, not the command text.

## Unverified items

* Whether 13.1, the NetScaler Console service, or Console agents are affected (sources silent).
* Any public proof of concept or exploitation (bulletin silent; none found in a web search at 15:20 GMT).
* How Console syslog lands in Sentinel, and the command wording used for user, group and role changes.
* [OUR READING] That `ADM_User` in ADC `CMD_EXECUTED` messages carries the Console user when the Console drives a
  change. NetScaler documents the field but not that meaning.
* Why the bulletin and the CVE record differ on attack vector and subsequent impacts.

## Contents

| Path | What it is |
|---|---|
| `kql/citrix-netscaler-console-cve-2026-120869-hunting.kql` | 14 hunts, all OUR PATTERN: Q1, Q1b, Q1c inventory (who reaches the Console IPs, Defender devices talking to it, Defender KB ingest check); Q2 allowed sources outside admin networks; Q2b public sources (internet exposure); Q2c sources new since disclosure; Q2d non-admin Defender devices; Q2e proxy requests; Q3 commands from Remote_ip outside admin networks; Q3b login failures and lockouts; Q3c users recovered to default credentials; Q4 user, group, role and policy changes; Q5 DEVICECONFIG commands on managed instances; Q5b ADC and Gateway commands from the Console |
| `sigma/*.yml` | 5 rules, all OUR PATTERN: public source to Console IP (firewall), Windows device to Console IP (network_connection), user recovered to default credentials (Console syslog), DEVICECONFIG command (Console syslog), ADC command from Console IP (ADC syslog) |
| `sigma/converted/` | Kusto output for no pipeline, microsoft_xdr, microsoft_365_defender, sentinel_asim and azure_monitor |
| `scripts/check-netscaler-console.sh`, `scripts/Check-NetScalerConsole.ps1` | Read-only offline checkers with identical output and exit codes |
| `tests/` | Case table, bash tests, Pester tests (with parity), synthetic fixtures, KQL parse check, `run_all.sh` |

Lists to fill in each KQL query: `ConsoleIPs` (or `_GetWatchlist('NetScalerConsole')`), `AdminNets`, `AdminDevices`,
`ConsoleHosts`, `ManagedInstanceIPs`. They ship empty, so the queries return nothing until you fill them. The Sigma
rules use the RFC 5737 placeholder 192.0.2.10 for the Console IP; replace it.

### Sigma conversion (sigma-cli, pySigma Kusto backend)

`sigma check`: 0 errors, 0 condition errors, 0 issues. Only the Windows network rule converts on the four Microsoft
pipelines (`DeviceNetworkEvents` on microsoft_xdr and microsoft_365_defender, `imNetworkSession` on sentinel_asim,
`SecurityEvent` on azure_monitor). The firewall rule and the three NetScaler syslog rules have no table mapping there
("Unable to determine table name from rule") and convert only without a pipeline, as expressions or keyword searches
you point at your own table. Use the matching KQL hunts (Q2b, Q3c, Q5, Q5b) instead.

## Log sources used (documented by NetScaler)

* NetScaler ADM 14.1 Release Syslog Message Reference (Console): GUI, CLI, API and SNMP `CMD_EXECUTED` ("User %s -
  Remote_ip %s - Command ... - Status ..."); `DEVICECONFIG CMD_EXECUTED` ("Logs the command executed on the device",
  adds Message); `EVENT LOGINFAILURE` ("Invalid %s login for user %s from client IP Address %s OR User Account Locked
  for %s client IP Address %s"); `EVENT PASSWORDRECOVERYSUCCESS` ("NetScaler ADM user recovered to default
  credentials"). That reference documents no successful-login message, so we do not hunt one.
* NetScaler ADC 14.1 syslog reference and the ADC logs page: `CMD_EXECUTED` with "User - ADM_User - Remote_ip -
  Command - Status".

## Checkers

Strictly read-only. They read the values and files you pass; no network, no writes, no other programs, no payloads.
They print counts, IPs and line numbers from logs, never log content or user names.

```
bash scripts/check-netscaler-console.sh --version 14.1-73.36
bash scripts/check-netscaler-console.sh --inventory inventory.csv          # header: name,product,version
bash scripts/check-netscaler-console.sh --inventory inventory.csv --log console-syslog.txt --admin-net 192.0.2.0/24
pwsh -File scripts/Check-NetScalerConsole.ps1 -Version "14.1 Build 74.34" -Log console-syslog.txt -AdminNet 192.0.2.0/24
```

| Exit | Verdict | Meaning |
|---|---|---|
| 0 | PATCHED | Console 14.1 at or above 14.1-74.34. Not proof the appliance was not accessed before |
| 1 | VULNERABLE | Console 14.1 below 14.1-74.34. Upgrade now |
| 2 | NOT LISTED | A Console release other than 14.1 (such as 13.1). CTX697320 does not list it; check with Citrix |
| 3 | UNKNOWN | Product other than Console (service, agent, ADC), missing or unparsed build, or a log-only run with nothing to review |
| 4 | Usage or read error | |
| 5 | LOG REVIEW | Log lines to check: commands or login failures from outside `--admin-net`, users recovered to default credentials, user, group, role or policy commands, DEVICECONFIG commands |

Worst wins: 1 > 5 > 2 > 3 > 0. Builds are read as Citrix writes them: `14.1-74.34` or `14.1 Build 74.34`. Products
`console`, `netscaler console`, `adm` and `netscaler adm` (and "citrix" forms) count as the Console.

## Testing

`tests/run_all.sh` runs shellcheck, PSScriptAnalyzer, the bash tests, the Pester tests (including bash versus
PowerShell parity on every case), guards (no network, write or exec primitives; fixtures marked `FIXTURE_ONLY` with
RFC 5737 IPs only; no IP literals in the KQL; only the RFC 5737 placeholder in Sigma; no em or en dashes; banned
names checked by sha256; wording guards for severity, scores, exploitation, scope and labels), the KQL parse check,
both checkers in a bwrap sandbox with no network and a read-only filesystem with a sha256 before and after check, and
`sigma check` plus conversions compared with `sigma/converted/` (`REGEN=1` rewrites them). It stops at the first
failure.

## ATT&CK mapping (MITRE)

T1190 Exploit Public-Facing Application, T1133 External Remote Services, T1078 Valid Accounts, T1098 Account
Manipulation, T1072 Software Deployment Tools, T1552 Unsecured Credentials (stored instance profiles).

## Sources

Primary:

* Citrix security bulletin CTX697320: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320
  (read through the public view https://support.citrix.com/external/article?articleNumber=CTX697320, 12 Nov 15:06 GMT)
* cve.org: https://www.cve.org/CVERecord?id=CVE-2026-120869 (15:04 GMT)
* NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120869 (15:04 GMT)
* CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (JSON feed, catalogue 2026.11.10)
* MITRE CWE-287: https://cwe.mitre.org/data/definitions/287.html ; MITRE ATT&CK: https://attack.mitre.org/
* NetScaler Console 14.1 overview (ADM rebrand note): https://docs.netscaler.com/en-us/netscaler-application-delivery-management-software/current-release/overview
* NetScaler ADM 14.1 syslog reference: https://developer-docs.netscaler.com/en-us/netscaler-adm-syslog-message-reference/current-release.html
* NetScaler ADC 14.1 syslog reference: https://developer-docs.netscaler.com/us/en/netscaler-syslog-message-reference/current-release.html
* NetScaler ADC logs page: https://docs.netscaler.com/us/en/citrix-adc/current-release/observability/logs.html
* Citrix downloads, NetScaler Console: https://www.citrix.com/downloads/citrix-application-management/product-software/

## Changelog

* 1.0.1 (12 Nov 2026): KEV note now cites BOD 26-04 (issued 10 Jun 2026). CISA's directive pages, checked 12 Nov 2026 19:45 GMT,
  say the 2021 KEV directive was revoked and superseded by BOD 26-04. Added a gate that fails on the old directive number.
  No change to detections, checkers or fixtures.
* 1.0.0 (12 Nov 2026): first release.