On November 12, Citrix disclosed 28 vulnerabilities affecting NetScaler ADC and Gateway, 9 of which are critical (CVSS 4.0 scores ranging from 6.9 to 9.5). There are no known exploits at this time, nor is there a workaround. netscaler-quickcheck v18.12 checks the bulletin and was run in the lab both before and after the upgrade to 14.1-73.58.
What the run on CTX697305 tells us
- Build per train against the fixed values 14.1-73.57, 13.1-64.39, 14.1-FIPS 73.58, and 13.1-FIPS/NDcPP 37.293. Verdict specifies the published build as the target; for 14.1, this is 73.58.
- CVE-2026-120868 (Package Processing, 9.3) has no configuration requirement: Every appliance running the fix build is red, regardless of its role.
- The remaining CVEs, listed according to the bulletin's testing steps, each as a separate finding. Where we must make assumptions, this is indicated in the rule text.
- CVE-2026-111348 affects logging:
httperror-Logs from before the upgrade may contain login credentials. Back them up and end sessions after the upgrade. - There are no log indicators yet; crash detection covers the category of memory errors.
New in v18.0
Since v18.0, extensions have been added almost daily, validated on operator gateways:
- Cloud proxies such as Netskope or Zscaler: Many users behind a single IP address are no longer considered attackers; checks on a per-account basis remain in effect
- nFactor: An incorrect password entered after successfully passing the first factor is recognized as a user error
- Recommendations for each address, ranging from typos to outdated saved passwords to "spraying"
- Comparison with the last run: new and resolved findings, by CVE
- Note: If log rotation does not cover the audit window
- Scanner payloads in CSP reports on the login page, asking about a commissioned penetration test
- Optional: Interactive shell sessions without logging in and suspicious commands
- Findings codes in JSON for SIEM, significantly shorter runtime
Every version that ran on an appliance has been frozen. The validated releases are in the repo.
If you're applying the patch now: run it before and after the upgrade. The comparison shows which CVEs have been fixed.
Repository: github.com/ceterion/netscaler-quickcheck
Contact: netscaler-integrity@ceterion.com