CVE-2026-120869: Authentication Bypass in Citrix NetScaler Console
This text was generated using artificial intelligence (AI).Citrix published the vulnerability on November 12, 2026. CVE-2026-120869 for the Citrix NetScaler Console Published. Affected are versions prior to 14.1-74.34. A fix is available starting with version 14.1-74.34 available.
The vulnerability allows an unauthenticated attacker to bypass authentication controls through an HTTP request and gain access to restricted resources of the NetScaler Console. The documented CVSS-4.0 score is 9,3. At the time of publication, there is no known active exploitation of CVE-2026-120869.
CVE-2026-120869 affects Citrix NetScaler Console in versions prior to 14.1-74.34. The attack path is based on an unauthenticated HTTP request that can bypass authentication controls.
The published CVSS-4.0 entry describes a network-based attack with low attack complexity. No privileges or user interaction are required for access. The assessment indicates high impact on confidentiality, integrity, and availability of the affected component.
Check Patch Status and Limit Access
The priority measure is to update the Citrix NetScaler Console to version 14.1-74.34 or higher. Organizations should check the patch status and the exposure of their NetScaler Console instances and prioritize updating affected systems.
If the update cannot be applied yet, network access to the management interface should be restricted to trusted networks. This measure reduces potential access paths until the fix is installed.
Citrix NetScaler Console is commonly used in enterprises and public authorities in the DACH region. NIS-2 obligated organizations in Germany and Austria, as well as KRITIS operators, should prioritize the vulnerability within their patch management processes — similar requirements apply in Switzerland under the revised Information Security Act (ISG) with reporting obligations to BACS. If a successful exploitation leads to a data protection incident involving personal data, there is a reporting obligation to the relevant supervisory authority within 72 hours under Art. 33 GDPR.
For ongoing operations, checking patch statuses, prioritizing affected systems, and continuous vulnerability and vendor risk monitoring should be part of a regulated process.
Visibility of Externally Accessible NetScaler Console Instances
Citrix NetScaler Console is externally identifiable as a web application. For the evaluation of CVE-2026-120869, it is therefore relevant which instances are accessible and whether they use a version prior to 14.1-74.34.
LocateRisk makes externally accessible systems and deployed software visible. This allows exposed NetScaler Console instances to be identified for examination and prioritization. LocateRisk does not necessarily detect the specific vulnerable version; verification of the patch status remains necessary.
For long-term management, the ongoing assessment of technology dependencies in Cyber Vendor Risk Management can be additionally considered.
Am I affected?
The affected component is Citrix NetScaler Console in the versions mentioned above; the vulnerability was fixed in 14.1-74.34. Those who want to know whether Citrix NetScaler Console is even visible in their externally accessible infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
CVE-2026-120869 is a critical vulnerability in the Citrix NetScaler Console that allows an unauthenticated attacker to bypass authentication controls and access restricted resources via an HTTP request. The CVSS 4.0 score is 9.3.
The immediate action is to update to version 14.1-74.34 or higher. If an immediate patch is not possible, network access to the management interface should be restricted to trusted networks to reduce the attack surface.
Status: November 12, 2026. This post is for general information purposes only and is not legal, security, or action advice for specific cases. The IT security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-120869
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français