CVE-2026-120869 - Vulnerability Details - OpenCVE

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Citrix Netscaler	Console

No data.

No data.

References

Link	Providers
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320

History

Sun, 15 Nov 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Citrix Netscaler Citrix Netscaler console
Vendors & Products		Citrix Netscaler Citrix Netscaler console

Fri, 13 Nov 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Thu, 12 Nov 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
Title		An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
References		https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: NetScaler

Published: 2026-11-12T14:03:14.594Z

Updated: 2026-11-12T14:03:14.594Z

Reserved: 2026-11-03T00:53:55.696Z

Link: CVE-2026-120869

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-11-12T14:17:23.990

Modified: 2026-11-12T22:09:39.233

Link: CVE-2026-120869

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120869", "assignerOrgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "state": "PUBLISHED", "assignerShortName": "NetScaler", "dateReserved": "2026-11-03T00:53:55.696Z", "datePublished": "2026-11-12T14:03:14.594Z", "dateUpdated": "2026-11-12T14:03:14.594Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "shortName": "NetScaler", "dateUpdated": "2026-11-12T14:03:14.594Z"}, "title": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance", "datePublic": "2026-11-12T13:57:00.000Z", "affected": [{"vendor": "Citrix NetScaler", "product": "Console", "versions": [{"status": "affected", "version": "0", "lessThan": "14.1-74.34", "versionType": "patch"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance "}]}], "references": [{"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Console", "vendor": "Citrix NetScaler", "versions": [{"lessThan": "14.1-74.34", "status": "affected", "version": "0", "versionType": "patch"}]}], "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance"}], "id": "CVE-2026-120869", "lastModified": "2026-11-12T22:09:39.233", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "type": "Secondary"}]}, "published": "2026-11-12T14:17:23.990", "references": [{"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320"}], "sourceIdentifier": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "vulnStatus": "Awaiting Analysis"}