CVE-2026-120869
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
CVE List Score used
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Record
CVE-2026-120869- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Updated
- 2026-11-12
EUVDEUVD-2026-124482
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Record
EUVD-2026-124482- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-7h45-cgv5-858r
An unauthenticated attacker can bypass authentication controls to access restricted resources on...
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Record
GHSA-7h45-cgv5-858r- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-12
NVD
An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance
- Record
CVE-2026-120869- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-12
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| products, severity, title | CVE List | |
| aliases, references, severity, title | GitHub Advisories | |
| aliases, products, published, severity | EUVD | |
| first indexed | NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-120869 is a critical vulnerability (CVSS 9.3) in Citrix Netscaler Console, published November 12, 2026. No source lists public exploit code. No source names a fixed version.