Skip to content
OpenAdvisories
High NCSC-2026-0491 7 CVEs

Meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console.

Published Nov 12, 2026 · Updated Nov 12, 2026 · nl

Vendor: Citrix Product: NetScaler Product: NetScaler ADC  Product: NetScaler ADC and NetScaler Gateway Product: Secure Access Client for Windows

Summary

Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console.

Details

Interpretaties
Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client for Windows, NetScaler ADC, NetScaler Gateway en NetScaler Console. De kwetsbaarheden hebben CVSS v4.0-scores variërend van 6.9 tot 9.5 en omvatten onder andere geheugenbeschadiging (Memory Corruption), authenticatieomzeiling (Improper Authentication) en privilege-escalatie (Improper Privilege Management).

Misbruik van de kwetsbaarheden kan leiden tot Denial-of-Service, ongeautoriseerde toegang tot afgeschermde resources of het verkrijgen van SYSTEM-rechten op een Windows-systeem. Meerdere kwetsbaarheden in NetScaler ADC en Gateway kunnen op afstand worden misbruikt zonder voorafgaande authenticatie. Voor andere kwetsbaarheden is lokale toegang of een specifieke productconfiguratie vereist.

Oplossingen
Citrix heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • Medium 5.9
    CVE-2026-111347

    go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

    go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoi…

    opsre go-ldap-admin
  • Medium 5.4
    CVE-2026-111346

    ZenTao PMS through 22.6 Authorization Bypass via action::editComment

    ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify…

    easysoft zentaopms
  • Medium 5.4
    CVE-2026-111348

    Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

    Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts …

    likeshop likeshop
  • Medium 5.3
    CVE-2026-111349

    Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

    Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or…

    puemos craftplan
  • Medium 4.3
    CVE-2026-111343

    pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}

    pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain u…

    pig-mesh Pig
  • Medium 4.3
    CVE-2026-111344

    APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description

    APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips sp…

    apitable apitable
  • Medium 4.3
    CVE-2026-111345

    Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id

    Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant…

    polonel trudesk

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697280&articleTitle=Citrix_Secure_Access_Client_for_Windows_Security_Bulletin_for_CVE_2026_118268
  • Reference
    https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697305&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin
  • Reference
    https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320&articleTitle=Citrix_NetScaler_Console_Security_Bulletin_for_CVE_2026_120869