Citrix NetScaler CTX697305: Why the 9.3 Matters More Than the 9.5

Most NetScaler bulletins have a precondition column. Most NetScaler teams use it to scope which appliances can wait. CTX697305, Citrix’s November 12 bulletin covering 28 memory-safety CVEs, has one too — and one entry that makes it irrelevant.

The three CVEs to know

CVE-2026-107412 (9.5) — multiple pre-auth memory overflows on appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. CERT-EU confirmed reachable without authentication. High score, real precondition.

CVE-2026-107413 (8.7) — SAML authentication overflow. Requires a SAML action configured. Availability High, C/I None per CVSS 4.0 vector. Narrower scope: SAML-federated deployments only.

CVE-2026-120868 (9.3) — memory overflow in core packet processing. No precondition. Affects every deployment in the default configuration. No workaround. The upgrade is the response.

The 9.3 is why a load balancer that has never been configured as a Gateway needs this patch just as urgently as the remote-access box.

Fixed builds

Branch Fixed build
14.1 standard 14.1-73.57 (download: 14.1-73.58)
13.1 standard 13.1-64.39
14.1 FIPS 14.1-73.58 FIPS
13.1 FIPS/NDcPP 13.1-37.293

October builds 14.1-73.49 and 13.1-64.32 are vulnerable again. 12.1 and 13.0 are EOL — no fix.

One more thing worth flagging: 27 of the 28 CVEs are worded as denial of service, but 10 of those carry a CVSS 4.0 vector that rates confidentiality, integrity, and availability all High. The bulletin doesn’t reconcile the two. Plan for the higher reading.

No exploitation confirmed. Not in CISA KEV. No public PoC as of November 13 — but that’s a calendar statement, not a difficulty statement. Earlier NetScaler bulletins were weaponized within days of release.

Full analysis (precondition table, hunt steps, HA pair guidance)https://threataft.com/articles/citrix-netscaler-ctx697305-28-cves-november-2026