CVE-2026-111338 in citrix netscaler adc
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Affected software: citrix netscaler adc, citrix netscaler gateway
Scores
- CVSS: 6.9 (medium)
- EPSS: 0.13% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-13
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Citrix NetScaler ADC and Gateway for the second batch of CTX697305 flaws (EPA, ICA proxy, management plane, protocols, logging)
Patch or upgrade. Citrix bulletin CTX697305 also fixes fifteen flaws in NetScaler ADC and Gateway: memory overflows in Endpoint Analysis (EPA/EPAS) and the ICA proxy (both rated 9.3), the management plane, SSL/TLS/DTLS, HTTP/2, HTTP/3 (QUIC), SIP ALG and DNS logging, GSLB, BGP, protocol load balancing, Application Firewall decompression, policy-expression Base64 decoding and authentication requests, a reboot-loop flaw, and a flaw that writes authentication material to a log file. Installing the fixed build is the only complete fix.
Applies to: Citrix NetScaler ADC and NetScaler Gateway builds listed as affected in bulletin CTX697305 (published 13 November 2026).
- Find your NetScaler ADC and Gateway builds: in the GUI under System > System Information, or run 'show version' on the CLI.
- Compare them with the fixed builds listed in Citrix bulletin CTX697305 for your release line.
- Download the fixed build from the Citrix downloads portal and install it on every appliance, starting with internet-facing Gateway virtual servers (EPA/EPAS scans and ICA proxy run there). Upgrade both nodes of an HA pair and every GSLB site.
- If you cannot patch at once, check which features you use (EPA, ICA proxy, HTTP/3, GSLB, BGP, SIP ALG, DNS logging, Diameter, MQTT, RADIUS or SIP load balancing, HTTP/2, Application Firewall) and limit who can reach those virtual servers. Never expose the management interface (NSIP) to the internet.
- After the upgrade run 'show version' again and confirm the new build on each node.
- Because one flaw writes authentication material to a log file, rotate the credentials and secrets used by NetScaler authentication (LDAP bind accounts, RADIUS secrets, service accounts) after patching, and remove copies of old NetScaler log files you keep elsewhere.
- Watch the appliances for unexpected restarts, reboot loops or packet engine crashes, which can point to exploitation attempts against these flaws.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.