VulnHub

Real-time Cybersecurity News

Critical

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

The Hacker News
CVEVulnerabilityCritical

Overview

Citrix has issued patches for 12 critical vulnerabilities affecting its NetScaler products, including NetScaler ADC, NetScaler Gateway, and NetScaler Console. These flaws could allow attackers to perform authentication bypass or cause denial-of-service (DoS) attacks. One of the most critical vulnerabilities, identified as CVE-2026-120868, has a high severity rating of 9.3 on the CVSS scale, indicating it poses a significant risk. Companies using these products should prioritize applying the patches to protect against potential exploitation. The vulnerabilities could impact the integrity and availability of services relying on these Citrix solutions.

Key Takeaways

  • Affected Systems: Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix NetScaler Console
  • Action Required: Citrix has released patches for the vulnerabilities in NetScaler ADC, NetScaler Gateway, and NetScaler Console.
  • Timeline: Newly disclosed

Original Article Summary

Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet

Impact

Citrix NetScaler ADC, Citrix NetScaler Gateway, Citrix NetScaler Console

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Citrix has released patches for the vulnerabilities in NetScaler ADC, NetScaler Gateway, and NetScaler Console. Users are advised to apply these patches immediately to mitigate the risks associated with these vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Critical.

Read Original Article

Related Coverage

Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry

The Hacker News

A significant vulnerability in Red Hat Quay has been identified, allowing attackers to read and overwrite private container images within any registry. This flaw is particularly concerning because Quay enables anonymous access by default, meaning attackers can exploit this vulnerability without needing an account. Even if anonymous access is disabled, anyone with a valid account can still take advantage of the flaw. Red Hat has released fixed builds for eight versions of Quay to address this issue. Organizations using Quay should prioritize updating their systems to prevent potential data breaches and unauthorized access to sensitive container images.

Nov 12, 2026

186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

The Hacker News

Researchers have discovered a network of 186 fake domains that impersonate legitimate AI tools. These lookalike sites are designed to trick users into clicking on links that lead to malware, specifically ClickFix-style lures that hijack browser functions and manipulate search results. This tactic, referred to as TypoPrompting, exploits users' familiarity with popular AI applications to redirect them to malicious content. As a result, unsuspecting users may unintentionally download harmful software or have their online activities compromised. This incident serves as a reminder for users to be cautious when accessing AI tools and to verify the authenticity of websites before entering any personal information.

Nov 12, 2026

SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The Hacker News

A recent campaign is exploiting a serious vulnerability in ConnectWise ScreenConnect, a remote access software used by many managed service providers (MSPs). Researchers from Blackpoint Cyber's Adversary Pursuit Group found that attackers are leveraging a previously patched flaw identified as CVE-2026-84869, which has a high severity score of 9.9. This vulnerability allows unauthorized access during support sessions, potentially opening the door for further attacks on MSPs and their clients. The ongoing exploitation of this flaw underscores the need for users to ensure they have applied the latest security updates. Companies relying on ScreenConnect should take immediate action to protect their systems from potential compromises.

Nov 12, 2026

Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs

The Hacker News

Google Cloud has issued a warning regarding three vulnerabilities found in AMD Turin CPUs used in their virtual machines (VMs). These flaws could allow an attacker to access data from other processes running on the same processor core within a VM. Google has already implemented measures to prevent attacks between VMs and between VMs and their host systems. However, to fully protect against these vulnerabilities, users must apply a patch to the guest operating system and restart their VMs. This situation is significant because it highlights the potential risks of shared resources in cloud environments, where multiple users operate on the same hardware.

Nov 12, 2026

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News

A serious vulnerability has been discovered in MongoDB Server, identified as CVE-2026-118383. This flaw allows attackers to send two specific requests that can cause the database server to crash. The issue arises particularly when a server, which is lagging behind in updates, is promoted to the main server role. MongoDB has responded quickly, releasing fixed versions to address this vulnerability. It's crucial for users of MongoDB to apply these updates to prevent potential disruptions in their database operations, especially in environments that rely on server failover for continuity.

Nov 12, 2026

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

The Hacker News

Node.js has patched 16 vulnerabilities, including critical flaws in its HTTP/2 support that could allow unauthenticated users to crash servers running versions 24.x and 26.x. One vulnerability could lead to a denial-of-service attack, while another could expose sensitive data by sending memory contents from the server to clients, potentially revealing information meant for other connections. The fixed versions are 22.23.5, 24.22.3, and 26.13.1. It’s crucial for developers and organizations using Node.js to update their systems to these latest versions to protect against these issues and ensure server stability and data security.

Nov 12, 2026