Is your NetScaler Console exposed to CVE-2026-120869?
Citrix published security bulletin CTX697320 on 12 November 2026 for CVE-2026-120869, a Critical unauthenticated authentication bypass in Citrix NetScaler Console, formerly NetScaler ADM. The bulletin says an unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance, with the precondition of access to the Citrix NetScaler Console IP. Supported affected versions are listed as 14.1 before 14.1-74.34. Cloud Software Group strongly urges customers to install 14.1-74.34 or later as soon as possible.
Citrix Critical. Upgrade NetScaler Console to 14.1-74.34 or later.
Citrix security bulletin CTX697320 rates CVE-2026-120869 Critical. The bulletin's CVSS 4.0 base score is 9.4 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), with the precondition Access to Citrix NetScaler Console IP. The official CVE record, published by the NetScaler CNA, gives a different CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L). We show both scores and do not reconcile them. The bulletin does not mention exploitation, and the CVE was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 12 November 2026, 15:14 GMT. Cloud Software Group strongly urges affected customers to install 14.1-74.34 or later as soon as possible. The bulletin does not describe a workaround. Citrix also strongly recommends that customers subscribe to bulletin alerts.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 12 November 2026, 19:56 GMT.
At a Glance
Based on Citrix security bulletin CTX697320, the official CVE record, the NVD record, and CISA's KEV catalogue, checked at 12 November 2026, 15:14 GMT, and on the Citrix download page, checked at 12 November 2026, 15:40 GMT. Last updated 12 November 2026, 19:56 GMT.
Citrix Critical (9.4 and 9.3)
The bulletin rates it Critical, with a CVSS 4.0 base score of 9.4 and vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, and the precondition Access to Citrix NetScaler Console IP. The official CVE record from the NetScaler CNA gives 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L (network attack vector, subsequent-system impacts Low). We show both scores and do not reconcile them. NVD published its record at 14:17 GMT on 12 November 2026. Status was Received when we checked, and NVD had not published its own score or a CWE.
Bulletin silent on exploitation; not in KEV
The bulletin does not mention exploitation. We do not treat that silence as a statement that there has been none. CVE-2026-120869 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 12 November 2026, 15:14 GMT. That catalogue (2026.11.10) was released at 19:03 GMT on 10 November 2026, before this disclosure. Recheck KEV. We did not find public exploit code for this CVE in a search at that time.
Console 14.1 before 14.1-74.34
The bulletin lists the following supported versions of Citrix NetScaler Console as affected: 14.1 before 14.1-74.34. The official CVE record lists the product as Console, with affected versions 0 less than 14.1-74.34 and default status unaffected. We do not treat other release lines as in or out of scope beyond what those sources say. The checker reports 13.1 as NOT LISTED, and the cloud service and Console agents as UNKNOWN, because the bulletin does not mention them. Official NetScaler documentation says the product was rebranded from NetScaler ADM to NetScaler Console starting at the 14.1-17.x build.
14.1-74.34 or later
Cloud Software Group strongly urges affected customers of Citrix NetScaler Console to install the relevant updated versions as soon as possible: 14.1-74.34 and later releases. The Citrix download page listed NetScaler Console Release (Maintenance Phase) 14.1 Build 74.34, dated 12 November 2026, when we checked at 12 November 2026, 15:40 GMT. The bulletin does not describe a workaround.
Citrix first published security bulletin CTX697320. The bulletin changelog records 2026-11-12 Initial Publication.
The bulletin's last modified time on the Citrix support article.
The official CVE record lists datePublic for CVE-2026-120869.
The NetScaler CNA published the official CVE record, with a CVSS 4.0 score of 9.3.
NVD published its record. Status was Received when we checked. NVD had not published its own score or a CWE.
We checked the bulletin, the CVE and NVD records, and CISA's KEV catalogue 2026.11.10. The CVE was not listed. Recheck those sources.
The Citrix download page listed NetScaler Console Release (Maintenance Phase) 14.1 Build 74.34, dated 12 November 2026.
What Citrix says
A vulnerability has been discovered in Citrix NetScaler Console. The bulletin describes CVE-2026-120869 as: an unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance. The precondition is Access to Citrix NetScaler Console IP. It is classified as CWE-287, Improper Authentication. Citrix gives no further technical detail in the bulletin. Cloud Software Group strongly urges affected customers to install 14.1-74.34 and later releases as soon as possible. The bulletin does not describe a workaround. Citrix also strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified.
Two Critical scores, shown separately
The bulletin's CVSS 4.0 base score is 9.4, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, with the precondition Access to Citrix NetScaler Console IP. The official CVE record from the NetScaler CNA uses 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. The attack vector and subsequent-system impact ratings differ. We show both scores and do not reconcile them. NVD published its record at 14:17 GMT on 12 November 2026. Status was Received when we checked. NVD had not published its own score or a CWE; it repeats the CNA score. CWE-287 appears in the bulletin; it is not listed in the CVE or NVD records we checked.
Formerly NetScaler ADM
This bulletin uses the current product name, Citrix NetScaler Console, and lists an on-premises 14.1 build line. Official NetScaler documentation states that, starting from the 14.1-17.x build, NetScaler ADM was rebranded to NetScaler Console, and that earlier builds used the NetScaler ADM name. That rename is not stated in CTX697320 itself. The bulletin does not mention NetScaler Console service, the cloud offering, or Console agents, and we do not treat those offerings as in or out of scope on the basis of this bulletin. The checker reports them as UNKNOWN.
Exploitation and CISA KEV
The bulletin does not mention exploitation, indicators of compromise, or public exploit code. We do not treat that silence as a statement that there has been no exploitation. When we checked at 12 November 2026, 15:14 GMT, CVE-2026-120869 was not in CISA's Known Exploited Vulnerabilities catalogue. That catalogue was still version 2026.11.10, released at 19:03 GMT on 10 November 2026, before this disclosure, so it predates the CVE and does not list it. Recheck KEV. We also did not find public exploit code for this CVE in a search at that time. We do not link or describe any exploit technique.
Who found it
The bulletin acknowledges the issue as discovered by the Cloud Software Group Product Security Team using advanced AI-assisted analysis. That is the vendor's own product security team.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.
Inventory every Console, including HA and DR, and upgrade to 14.1-74.34 or later
- Citrix: install Citrix NetScaler Console 14.1-74.34 or later as soon as possible. Cloud Software Group strongly urges this. The bulletin does not describe a workaround. The Citrix download page listed 14.1 Build 74.34, dated 12 November 2026, when we checked.
- Citrix: subscribe to receive alerts when a Citrix security bulletin is created or modified. Citrix strongly recommends this in CTX697320.
- Our advice: inventory every on-premises NetScaler Console appliance you run, including those you host for clients, and including HA and DR nodes, and check the build. Upgrade any 14.1 release before 14.1-74.34.
- Our advice: until those appliances are upgraded, restrict access to the Console management IP to a dedicated admin network or VPN, because the bulletin's precondition is access to that IP. Use your attack-surface data to confirm that none of those Console management interfaces are internet-facing.
Review 30 days of logs, admin users and managed jobs
- Our advice: Citrix has published no indicators of compromise. Do not expect a vendor IOC list in the bulletin. All hunts in the pack are our patterns.
- Our advice: if a Console was reachable and unpatched, review at least 30 days of Console audit logs and syslog for unexpected source addresses, and review admin users and unexplained configuration jobs pushed to managed NetScaler ADC or Gateway instances.
- Our advice: then rotate stored instance credentials and profiles, and review the managed appliances.
Proactive: Vendor Steps, Then Ours
Citrix's upgrade and alert subscription first, then our advice for finding every appliance, including HA and DR nodes, and limiting access until it is upgraded. Vendor steps and our advice are labelled separately.
Install 14.1-74.34 or later
Cloud Software Group, in bulletin CTX697320, strongly urges affected customers of Citrix NetScaler Console to install the relevant updated versions as soon as possible: 14.1-74.34 and later releases. The bulletin lists supported affected versions as 14.1 before 14.1-74.34. It does not describe a workaround. The Citrix download page listed NetScaler Console Release (Maintenance Phase) 14.1 Build 74.34, dated 12 November 2026, when we checked at 12 November 2026, 15:40 GMT.
Subscribe to Citrix bulletin alerts
Citrix, in the same bulletin, strongly recommends that all customers subscribe to receive alerts when a Citrix security bulletin is created or modified. The bulletin points to Citrix support alerts.
Inventory every Console you manage, including HA and DR nodes
Our advice: list every on-premises NetScaler Console appliance you run, in your own environment and any you host for clients, and include HA pairs and DR nodes. Record the build. MSPs often use Console to manage client ADC and Gateway fleets; include those appliances in the same inventory. Upgrade any 14.1 release before 14.1-74.34. The checker reports 13.1 as NOT LISTED, and the cloud service and Console agents as UNKNOWN, because the bulletin does not mention them. We do not treat other release lines as in or out of scope beyond what the bulletin and the CVE record say.
Restrict the Console management IP until it is upgraded
Our advice: the bulletin's precondition is Access to Citrix NetScaler Console IP. Until an appliance is on 14.1-74.34 or later, restrict that management IP to a dedicated admin network or VPN. Do not leave it reachable from general internal networks if you can avoid it.
Confirm none are internet-facing
Our advice: use your attack-surface and external-exposure data to confirm that no NetScaler Console management interface is internet-facing. If one is, treat it as a priority to upgrade and to restrict access, and follow the reactive steps as well. Q2b and the firewall Sigma rule in the pack are our patterns for helping with that check.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.
check-netscaler-console.sh
Read-only, offline checker. It reads a build you pass, or an inventory CSV with the header name,product,version, and optional saved Console syslog or audit exports. It never contacts Citrix or an appliance, never writes, and never prints log content or user names. Builds are read as Citrix writes them: 14.1-74.34 or 14.1 Build 74.34.
bash check-netscaler-console.sh --version 14.1-73.36
# Estate inventory (CSV header: name,product,version)
bash check-netscaler-console.sh --inventory inventory.csv
# Inventory plus a saved Console syslog or audit export
bash check-netscaler-console.sh --inventory inventory.csv --log console-syslog.txt --admin-net 192.0.2.0/24Check-NetScalerConsole.ps1
The same checks in PowerShell 7, with identical output and exit codes. It is also read-only and offline, and it never prints log content or user names.
pwsh -File Check-NetScalerConsole.ps1 -Inventory inventory.csv
pwsh -File Check-NetScalerConsole.ps1 -Version "14.1 Build 74.34" -Log console-syslog.txt -AdminNet 192.0.2.0/24KQL and Sigma
14 KQL hunts (Q1, Q1b and Q1c inventory; Q2 to Q2e sources and exposure; Q3, Q3b and Q3c commands, login failures and users recovered to default credentials; Q4 user, group, role and policy changes; Q5 and Q5b configuration jobs on managed instances). 5 Sigma rules, with Kusto conversions included. All of the hunts and rules are our patterns. Citrix published no indicators of compromise. None of the KQL has been run against a live tenant. Only the Windows network Sigma rule converts on Microsoft pipelines; the firewall rule and the three NetScaler syslog rules do not, and the pack README sets out that gap.
Verdicts
- PATCHEDConsole 14.1 at or above 14.1-74.34. Not proof the appliance was not accessed before the upgrade.
- VULNERABLEConsole 14.1 below 14.1-74.34. Upgrade now.
- NOT LISTEDA Console release other than 14.1, such as 13.1. CTX697320 does not list it; check with Citrix. The checker does not treat 13.1 as affected or safe.
- UNKNOWNA product other than Console, including the cloud service or Console agents, a missing or unparsed build, or a log-only run with nothing to review. The bulletin does not mention those offerings.
- LOG REVIEWSaved log lines to check: commands or login failures from outside your admin network, users recovered to default credentials, user, group, role or policy commands, or DEVICECONFIG commands.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED |
| 1 | VULNERABLE |
| 2 | NOT LISTED |
| 3 | UNKNOWN |
| 4 | Usage or read error |
| 5 | LOG REVIEW |
Worst wins: 1, then 5, then 2, then 3, then 0. The full pack zip contains 28 files: 14 KQL hunts, 5 Sigma rules and their Kusto conversions, both checkers, tests and the README.
Know the limits
- Both checkers are read-only and offline. They never fetch, never write, never contact Citrix or an appliance, and never print log content or user names.
- None of the KQL has been run against a live tenant. Tune it before relying on it. The KQL lists (Console IPs, admin networks, admin devices, Console host names and managed instance IPs) ship empty, so the queries return nothing until you fill them.
- All of the hunts and rules are our patterns. Citrix published no indicators of compromise, and the pack contains none.
- The checker reports 13.1 as NOT LISTED, not as affected or safe, because the bulletin does not mention it. It reports the NetScaler Console service (cloud) and Console agents as UNKNOWN for the same reason.
- Only the Windows network Sigma rule converts on the Microsoft pipelines (Defender, Sentinel ASIM and Azure Monitor). The firewall rule and the three NetScaler syslog rules have no table mapping there. The pack README describes that gap; use the matching KQL hunts (Q2b, Q3c, Q5, Q5b) instead.
- A PATCHED or clean hunt result is not proof the appliance was not accessed before the upgrade.
What is in the pack
| File | What it does |
|---|---|
| check-netscaler-console.sh | Read-only checker for Linux and macOS (bash) |
| Check-NetScalerConsole.ps1 | The same checker in PowerShell 7 |
| KQL (14 hunts) | Q1 to Q5b inventory, exposure, Console activity and managed-instance jobs |
| Sigma (5 rules) | Public source, Windows connection, recovered credentials, DEVICECONFIG, and ADC commands from the Console; Kusto conversions included |
| tests/ | Fixtures and tests (in the full pack) |
| README.md | Verified facts, Citrix advice versus ours, limits and usage |
Reactive: How to Hunt (Our Advice)
These hunts are CybaVerse advice. Citrix has published no indicators of compromise. None of the KQL in the pack has been run against a live tenant. CybaOps can run a hunt across the Consoles you manage and the ADC and Gateway instances they control.
There are no vendor indicators to search for
Our advice: Citrix has published no indicators of compromise for CVE-2026-120869. We do not invent any. All hunts and rules in the pack are our patterns. None of the KQL has been run against a live tenant.
Review 30 days of audit logs and syslog
Our advice: if a Console was reachable and not yet on 14.1-74.34, review at least 30 days of Console audit logs and syslog for unexpected source addresses, login failures, and users recovered to default credentials.
Review admin users and unexplained jobs on managed instances
Our advice: review Console admin users, groups and roles for anything new or changed. NetScaler Console can push configuration jobs to managed NetScaler ADC and Gateway instances. Look for unexplained jobs, unexpected configuration changes, or new management activity on those instances.
If a Console was exposed and unpatched, rotate stored credentials
Our advice: if a Console appliance was reachable and not yet on 14.1-74.34, treat stored instance credentials and profiles as at risk. Rotate those credentials, and review the managed ADC and Gateway appliances for unexpected accounts, configuration or traffic. Updating the Console stops new use of this flaw; it does not undo access or changes already made.
If you find unexpected access (our advice)
- Contain the affected Console management interface, and keep logs.
- Upgrade that appliance to 14.1-74.34 or later if it is not already on that build.
- Rotate stored instance credentials and profiles, and review admin users on the Console.
- Review managed NetScaler ADC and Gateway appliances for unexpected configuration jobs, accounts or traffic.
- Start incident response for every environment that Console could manage.
Upgraded does not mean clean
Installing 14.1-74.34 or later stops new use of this flaw. It does not undo authentication bypass, configuration jobs or credential use that already happened. Hunt the period before you upgraded, and review at least 30 days of audit logs and syslog if the appliance was reachable while unpatched.
NetScaler Console CVE-2026-120869 FAQ
Short answers based on Citrix security bulletin CTX697320, the official CVE record, the NVD record, CISA's Known Exploited Vulnerabilities catalogue, and the Citrix download page. We checked the bulletin, CVE, NVD and KEV sources at 12 November 2026, 15:14 GMT, and the download page at 12 November 2026, 15:40 GMT.
What is CVE-2026-120869?
It is an unauthenticated authentication bypass in Citrix NetScaler Console, published by Citrix on 12 November 2026 as security bulletin CTX697320. The bulletin's description is: an unauthenticated attacker can bypass authentication controls to access restricted resources on the appliance. The precondition is Access to Citrix NetScaler Console IP. It is classified as CWE-287, Improper Authentication. The official CVE record uses the same description, referring to the Citrix NetScaler Console appliance, and lists datePublic as 13:57 GMT on 12 November 2026.
What is the severity, and why are there two scores?
Citrix rates it Critical. The bulletin gives a CVSS 4.0 base score of 9.4, vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The official CVE record, published by the NetScaler CNA, gives 9.3, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. The attack vector and subsequent-system impact ratings differ. We show both scores and do not reconcile them. NVD published its record at 14:17 GMT on 12 November 2026. Status was Received when we checked. NVD had not published its own score or a CWE.
Which versions are affected?
The bulletin lists the following supported versions of Citrix NetScaler Console as affected: 14.1 before 14.1-74.34. The official CVE record lists product Console, affected versions 0 less than 14.1-74.34, and default status unaffected. We do not treat other release lines as in or out of scope beyond what those sources say. The checker reports 13.1 as NOT LISTED, and the NetScaler Console service and Console agents as UNKNOWN, because the bulletin does not mention them.
Is this the same product as NetScaler ADM?
Official NetScaler documentation says that, starting from the 14.1-17.x build, NetScaler ADM was rebranded to NetScaler Console, and that earlier builds used the NetScaler ADM name. CTX697320 itself uses the current name and does not mention the rename. The bulletin also does not mention NetScaler Console service, the cloud offering, or Console agents.
How do we fix it, and is there a workaround?
Cloud Software Group strongly urges affected customers to install Citrix NetScaler Console 14.1-74.34 and later releases as soon as possible. The bulletin does not describe a workaround. The Citrix download page listed 14.1 Build 74.34, dated 12 November 2026, when we checked. Our advice, until you have upgraded: restrict the Console management IP to a dedicated admin network or VPN, and confirm that no Console management interface is internet-facing. Citrix also strongly recommends that customers subscribe to bulletin alerts.
Is it being exploited, or in CISA KEV?
The bulletin does not mention exploitation, and we do not treat that silence as a statement that there has been none. CVE-2026-120869 was not in CISA's Known Exploited Vulnerabilities catalogue when we checked at 12 November 2026, 15:14 GMT. That catalogue (2026.11.10) was released at 19:03 GMT on 10 November 2026, before this disclosure, so it predates the CVE and does not list it. Recheck KEV. We did not find public exploit code for this CVE in a search at that time.
Did Citrix publish indicators of compromise?
No. The bulletin publishes none, and we do not invent any. All hunts and rules in the pack are our patterns. If a Console was reachable and unpatched, review at least 30 days of Console audit logs and syslog, review admin users, and look for unexplained configuration jobs on managed ADC and Gateway instances, then rotate stored instance credentials and profiles.
Who reported it?
The bulletin says it was discovered by the Cloud Software Group Product Security Team using advanced AI-assisted analysis. That is the vendor's own product security team.
What should we do first?
Follow Citrix first: install 14.1-74.34 or later as soon as possible, and subscribe to Citrix bulletin alerts. Our advice on top: inventory every on-premises Console you run, including those you host for clients and including HA and DR nodes; restrict the management IP to a dedicated admin network or VPN until it is upgraded; confirm none are internet-facing; and if a Console was reachable and unpatched, review at least 30 days of audit logs and syslog, review admin users and unexplained jobs, rotate stored instance credentials and profiles, and review managed appliances.
Who is this relevant to?
Anyone who runs on-premises Citrix NetScaler Console, especially 14.1 builds before 14.1-74.34, including HA and DR nodes. Our context, not a Citrix statement: MSPs often use Console to manage client ADC and Gateway fleets, so those appliances belong in the same inventory and review.
Need help checking every NetScaler Console you manage?
CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Citrix: Security bulletin CTX697320, Citrix NetScaler Console Security Bulletin for CVE-2026-120869 (first published 12:25 GMT on 12 November 2026, last modified 12:51 GMT the same day; changelog 2026-11-12 Initial Publication; checked at 12 November 2026, 15:14 GMT)
- CVE record: CVE-2026-120869 (NetScaler CNA; datePublic 13:57 GMT on 12 November 2026; datePublished 14:03 GMT the same day; checked at 12 November 2026, 15:14 GMT)
- NVD: CVE-2026-120869 (published 14:17 GMT on 12 November 2026, status Received, no NVD score or CWE when checked at 12 November 2026, 15:14 GMT)
- CISA: Known Exploited Vulnerabilities catalogue (catalogue 2026.11.10, released 19:03 GMT on 10 November 2026; checked at 12 November 2026, 15:14 GMT)
- NetScaler documentation: NetScaler Console 14.1 overview (rebrand from NetScaler ADM starting at 14.1-17.x; checked at 12 November 2026, 15:14 GMT)
- Citrix downloads: NetScaler Console product software (14.1 Build 74.34 listed, dated 12 November 2026; checked at 12 November 2026, 15:40 GMT)
- Citrix: subscribe to alerts when a Citrix security bulletin is created or modified (linked from CTX697320)