NetScaler fixes critical memory flaws, including one that affects default configurations
Separate fixed branches and configuration prerequisites matter more than the headline vulnerability count.
NetScaler administrators have a new reason to bring forward their maintenance window: a critical memory-safety flaw affects vulnerable ADC and Gateway appliances in their default configuration. Checking only whether an optional authentication feature is enabled will therefore miss part of the exposure.
The November 12 CERT-EU advisory covers 28 vulnerabilities. Two stand out for their severity and different prerequisites: CVE-2026-120868 has a CVSS score of 9.3 and requires no authentication; CVE-2026-107412 scores 9.5 and affects particular Gateway or AAA configurations. The vendor bulletin supplies the detailed configuration matrix and fixed releases. Those distinctions determine which systems need attention, rather than the larger number alone.
Start with the installed branch
A version number is useful only alongside its release branch. An administrator maintaining a FIPS build cannot take a fixed number from the ordinary 14.1 line and assume the same correction is installed. The advisory lists separate minimum versions for those deployments.
These are the floors named in the bulletin, not a recommendation to ignore subsequent supported updates. The practical task is to match the appliance's actual branch and build to the vendor's affected-version table, then use the corresponding supported update path. Inventory entries that say only “NetScaler” are not precise enough to close that task.
This also matters in redundant installations. Upgrading the node that normally carries traffic does not establish that its standby peer has been corrected. A failover can bring another software version into service. Recording the result per appliance is more useful than attaching one completed maintenance ticket to the entire service.
A severity score is not an incident report
CERT-EU reported no known exploitation or public proof of concept at publication. That is a dated assessment, not a guarantee that exploitation is impossible or will remain absent. Conversely, the severity scores do not prove that an attacker has already entered a particular network.
The distinction keeps two operational decisions separate. Patching reduces exposure to a documented vulnerability. Investigating a suspected compromise requires evidence from the organization's own systems and the applicable vendor guidance. Neither decision should be replaced by a headline that turns every memory flaw into a confirmed breach or an unqualified remote-code-execution claim.
Configuration checks still matter
The default-configuration issue broadens the first pass through the inventory. It does not make the other prerequisites irrelevant. The vendor's matrix remains necessary for understanding the additional exposure associated with Gateway and authentication configurations, and for avoiding the opposite mistake of treating every listed flaw as identical.
For a maintenance team, the sensible order is to identify affected builds, prioritize exposed services and apply the supported fixes with the normal recovery provisions for that environment. Configuration review can sharpen that priority; it cannot justify leaving a default-configuration vulnerability unpatched because a different feature is disabled.
Our Security coverage follows the same distinction between a vulnerability, evidence of exploitation and a confirmed incident. Here, the concrete deliverable is narrower than any of those headlines: a verified fixed build on every affected appliance, including the one that takes over when the primary stops responding.
