If your business uses Citrix NetScaler ADC or Gateway as the front door for remote work — the box your staff connect to from home, or the one your partners use to reach shared systems — you have patching to do before Monday morning.
What happened
On 12 November 2026, Cloud Software Group published security bulletins fixing 28 memory-related flaws across Citrix NetScaler ADC, NetScaler Gateway, NetScaler Console and the Secure Access Client, according to the CERT-EU advisory. Twelve of these are rated critical.
Two stand out:
- CVE-2026-120868 (CVSS 9.3) is a memory overflow in core packet processing. It needs no special feature enabled and no authentication to trigger, and the bulletin is explicit that all deployments are affected, including default configurations. There is no safe-by-configuration version of this appliance right now — if you run NetScaler, you are exposed.
- CVE-2026-120869 (CVSS 9.4) is an improper authentication flaw in NetScaler Console that, according to The Hacker News, lets an unauthenticated attacker skip the login screen entirely and reach restricted parts of the management console.
Separately, Citrix fixed two privilege-escalation bugs in Secure Access Client for Windows and Linux (CVE-2026-118268 and CVE-2026-118269, both CVSS 8.5) that let a low-privileged user jump straight to SYSTEM on Windows or root on Linux — relevant wherever staff laptops run the VPN client.
Why this matters for Swiss SMEs specifically
NetScaler ADC and Gateway are one of the most common VPN and remote-access appliances in use by Swiss small and mid-sized businesses — it is often the single device standing between the internet and your internal network, home-office staff and external partners. Citrix reports no exploitation of these flaws yet, and no public proof-of-concept is confirmed. But that is exactly the window that matters: history shows ransomware groups move within days of a patch being released, reverse-engineering the fix to build a working exploit. CERT-EU is explicit that internet-facing Gateway and AAA appliances should be upgraded first.
What to do today
- Identify every NetScaler ADC, Gateway and Console instance you run, including ones managed by a third-party IT provider on your behalf — ask them directly if you don't manage it yourself.
- Prioritise internet-facing Gateway and AAA virtual servers first, as recommended by CERT-EU, then move to internal appliances.
- Apply the official Citrix builds referenced in the bulletin — do not wait for a routine maintenance window; treat this as an emergency change.
- Update Secure Access Client on every staff laptop and workstation that uses it, not just the server side.
- Check logs for unusual authentication activity on NetScaler Console and Gateway going back to early November, even though no exploitation has been confirmed yet.
- Confirm with any partner or branch office connecting through your Gateway that their side is also patched — a shared appliance is only as safe as its weakest login.
The bigger picture
This is the latest in a steady run of critical, no-login vulnerabilities hitting the exact appliances businesses rely on for remote access, file transfer and VPN — SonicWall, Barracuda and now Citrix in recent weeks alone. The pattern is the same each time: a vendor patches quietly, attackers reverse-engineer the fix within days, and whoever hasn't updated becomes the easy target. This is now a normal part of running a business, not an occasional emergency.
We keep watching this space and will keep reporting the vulnerabilities that actually require same-week action. If managing patch cycles across VPN appliances, servers and staff devices is eating time you don't have, Flitz.ai (via The Mejlerö Company) supports Swiss SMEs with ongoing IT support, security basics like two-factor authentication, and sensible automation around day-to-day IT management — alongside a free network analysis if you want a second set of eyes on your current setup.
Switzerland.