Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Citrix NetScaler Console lets attackers skip login

CVE-2026-120869 · published 2 days ago
Summary

The NetScaler Console appliance does not properly verify a user's credentials, so anyone on the network can get past the login screen and reach areas meant for administrators. This could allow viewing or changing settings, exposing sensitive data, or disrupting services. Apply the vendor's security update or patch as soon as possible and restrict network access to the console.

What to do
  • Update citrix netscaler console to version 14.1-74.34 or later.
Affected software
VendorProductAffected versions
citrix netscaler console < 14.1-74.34
Original advisory text
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Timeline
Published12 Nov 2026
Updated14 Nov 2026
First seen12 Nov 2026
Sources
CVE-2026-120869 · NVD
CVE-2026-120869 · MITRE
Track software like this
Free during beta