{"id":"CVE-2026-120869","kind":"vulnerability","aliases":["CVE-2026-120869"],"related":[],"title":"Citrix NetScaler Console: unauthenticated attacker bypasses login to restricted resources","description":"An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance","summary":"An attacker with no account can get past the authentication checks on Citrix NetScaler Console and reach restricted resources. The sources give a CVSS score of 9.3 but do not describe what the attacker can do after getting in.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NetScaler Console","fixed":["14.1-74.34"],"affected":"< 14.1-74.34","ecosystem":"vendor"}],"ecosystems":[],"tags":["appliance","auth-bypass","citrix","infrastructure","netscaler-console","self-hosted"],"not_affected_if":[],"how_to_check":"In NetScaler Console, check the software version (System > About / version banner). Exposed if it is 14.1 and earlier than 14.1-74.34. Also check who can reach the Console IP: Citrix lists 'access to Citrix NetScaler Console IP' as the only pre-condition. The bulletin lists no 13.1 fix, so for 13.1 builds, ask Citrix support.","fix":"Upgrade NetScaler Console to 14.1-74.34 or later (Citrix bulletin CTX697320). No workaround is listed.","status":"open","published_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:00+00:00","updated_at":"2026-11-12T14:40:03+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T14:39:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Citrix NetScaler Console: unauthenticated attacker bypasses login to restricted resources","impact":"high","summary":"An attacker with no account can get past the authentication checks on Citrix NetScaler Console and reach restricted resources. The sources give a CVSS score of 9.3 but do not describe what the attacker can do after getting in.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["citrix","netscaler-console","appliance"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reaches restricted resources on the appliance","analyst_note":"Find the affected version ranges, fixed versions and remote reachability from the NVD entry and Citrix's security bulletin.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"NetScaler Console is an appliance that companies run to manage Citrix NetScaler deployments, so exposure depends on whether an instance is reachable by an attacker. The sources do not list affected versions or describe the configuration needed. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000674,"input_tokens":4491,"output_tokens":449,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected version ranges, fixed versions and remote reachability from the NVD entry and Citrix's security bulletin.","search":"'-120869':13A,16A '-2026':12A,15A '9.3':57B 'access':77C 'account':35B 'applianc':19B,85C 'attack':5A,32B,64B,71C 'auth':21B 'auth-bypass':20B 'authent':40B,74C 'bypass':6A,22B,73C 'check':41B 'citrix':1A,23B,43B,82C 'consol':3A,27B,45B,84C 'console':18A 'control':75C 'cve':11A,14A 'cvss':54B 'describ':61B 'get':37B,68B 'give':52B 'host':30B 'infrastructur':24B 'login':7A 'netscal':2A,26B,44B,83C 'netscaler':17A 'netscaler-consol':25B 'past':38B 'reach':47B 'resourc':10A,49B,79C 'restrict':9A,48B,78C 'score':55B 'self':29B 'self-host':28B 'sourc':51B 'unauthent':4A,70C","nicknames":[],"mitigations":[],"who_affected":"Self-managed NetScaler Console (formerly ADM) running 14.1 before 14.1-74.34 is affected. Citrix says an attacker needs no account, only network access to the Console IP, and the CVSS vector is adjacent-network (the NVD vector says network). Teams whose Console is on an isolated management network are less exposed. Other NetScaler Console versions are not named by the bulletin.","tier":"B","verified":{"fix":{"at":"2026-11-12T14:40:03Z","by":"analyst","doc":"https://support.citrix.com/external/article/697320","run_id":3739},"products":{"at":"2026-11-12T14:40:03Z","by":"analyst","doc":"https://support.citrix.com/external/article/697320","run_id":3739},"how_to_check":{"at":"2026-11-12T14:40:03Z","by":"analyst","doc":"https://support.citrix.com/external/article/697320","run_id":3739},"who_affected":{"at":"2026-11-12T14:40:03Z","by":"analyst","doc":"https://support.citrix.com/external/article/697320","run_id":3739}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["console","netscalerconsole"],"ptokens":["console","netscaler"],"labels":["appliance","authbypass","citrix","critical","infrastructure","netscalerconsole","selfhosted"],"campaign_type":null,"search_a":"'-120869':13A,16A '-2026':12A,15A 'attack':5A 'bypass':6A 'citrix':1A 'consol':3A 'console':18A 'cve':11A,14A 'login':7A 'netscal':2A 'netscaler':17A 'resourc':10A 'restrict':9A 'unauthent':4A","search_b":"'9.3':57B 'account':35B 'applianc':19B 'attack':32B,64B 'auth':21B 'auth-bypass':20B 'authent':40B 'bypass':22B 'check':41B 'citrix':23B,43B 'consol':27B,45B 'cvss':54B 'describ':61B 'get':37B,68B 'give':52B 'host':30B 'infrastructur':24B 'netscal':26B,44B 'netscaler-consol':25B 'past':38B 'reach':47B 'resourc':49B 'restrict':48B 'score':55B 'self':29B 'self-host':28B 'sourc':51B","search_c":"'access':77C 'applianc':85C 'attack':71C 'authent':74C 'bypass':73C 'citrix':82C 'consol':84C 'control':75C 'netscal':83C 'resourc':79C 'restrict':78C 'unauthent':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120869","severity":null,"published_at":"2026-11-12T14:17:23+00:00","modified_at":"2026-11-12T14:17:23+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120869:3739","url":"https://support.citrix.com/external/article/697320","severity":null,"published_at":"2026-11-12T14:40:03+00:00","modified_at":"2026-11-12T14:40:03+00:00","first_seen_at":"2026-11-12T14:40:03+00:00","fetched_at":"2026-11-12T14:40:03+00:00","note":"Read Citrix bulletin CTX697320: 14.1 before 14.1-74.34 affected, fixed in 14.1-74.34+. Vendor CVSS v4 9.4 with adjacent-network vector (AV:A), NVD says network. No exploitation/PoC seen; X and posts not searched.","cites":["https://support.citrix.com/external/article/697320"]}],"documents":[{"id":135689,"url":"https://support.citrix.com/external/article/697320","title":"Citrix NetScaler Console Security Bulletin for CVE-2026-120869 (CTX697320)","kind":"vendor","source":"analyst","publisher":null,"text":"Affected: NetScaler Console 14.1 before 14.1-74.34. Fix: 14.1-74.34 and later. Pre-condition: access to NetScaler Console IP. CWE-287. CVSS v4.0 9.4 (AV:A). Unauthenticated bypass of authentication to access restricted resources. Discovered by Cloud SG Product Security using AI-assisted analysis. Published 2026-11-12.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}