NETSCALER CONSOLE · CVE-2026-120869 · Infrastructure
FIX → 14.1-74.34 ✓ verified
An attacker with no account can get past the authentication checks on Citrix NetScaler Console and reach restricted resources. The sources give a CVSS score of 9.3 but do not describe what the attacker can do after getting in.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-managed NetScaler Console (formerly ADM) running 14.1 before 14.1-74.34 is affected. Citrix says an attacker needs no account, only network access to the Console IP, and the CVSS vector is adjacent-network (the NVD vector says network). Teams whose Console is on an isolated management network are less exposed. Other NetScaler Console versions are not named by the bulletin.
Who cares appliance, auth-bypass, citrix, netscaler-console, self-hosted
access to Citrix NetScaler Console IP as the only pre-conditionAn unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 14.1-74.34