CVE-2026-120868: Critical Citrix NetScaler ADC & Gateway Memory Overflow — Detection and Remediation Guide

---
title: Citrix NetScaler Suspicious Process Execution
description: Detects unexpected process execution on NetScaler appliances that may indicate post-exploitation activity following CVE-2026-120868 exploitation.
references:
  - https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  product: linux
  service: netscaler
detection:
  selection:
    - CommandLine|contains:
        - '/bin/sh'
        - '/bin/bash'
        - 'python'
        - 'perl'
        - 'curl'
        - 'wget'
        - 'nc '
        - 'netcat'
  filter:
    CommandLine|contains:
      - '/netscaler/'
      - '/nsconfig/'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative scripting
  - Citrix support diagnostics
level: high
---
title: NetScaler Management Interface Anomalous Access
description: Detects suspicious access patterns to NetScaler management interfaces that may indicate authentication bypass attempts.
references:
  - https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri|contains:
      - '/admin/'
      - '/api/'
      - '/mgmt/'
      - '/logon/'
    sc-status:
      - 200
      - 302
  filter:
    c-ip|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter
falsepositives:
  - Legitimate external administrative access
  - Security scanning tools
level: medium
---
title: NetScaler Configuration File Modification
description: Detects unauthorized modifications to critical NetScaler configuration files that may indicate persistence or defense evasion.
references:
  - https://thehackernews.com/2026/11/citrix-patches-12-netscaler-and-secure.html
author: Security Arsenal
date: 2026/11/15
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1078
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'PATH'
    name|contains:
      - '/nsconfig/ns.conf'
      - '/nsconfig/ssl/'
      - '/netscaler/aaa/'
      - '/etc/passwd'
      - '/etc/shadow'
    nametype: 'CREATE'
  condition: selection
falsepositives:
  - Legitimate configuration changes
  - Automated configuration management
level: high

// Hunt for suspicious process execution on NetScaler appliances via Syslog
Syslog
| where TimeGenerated > ago(7d)
| where Computer contains "netscaler" or Computer contains "ns"
| where ProcessName in ("sh", "bash", "python", "perl", "curl", "wget", "nc", "netcat")
| where not(SyslogMessage contains "/netscaler/" or SyslogMessage contains "/nsconfig/")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Detect anomalous HTTP requests to NetScaler management interfaces
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct contains "NetScaler" or DeviceProduct contains "Citrix"
| where RequestMethod == "POST"
| where RequestURL contains "/admin/" or RequestURL contains "/api/" or RequestURL contains "/mgmt/" or RequestURL contains "/logon/"
| where ApplicationProtocol == "HTTP" or ApplicationProtocol == "HTTPS"
| where not(SourceIP startswith "10." or SourceIP startswith "172.16." or SourceIP startswith "192.168.")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, DeviceAction
| order by TimeGenerated desc

// Monitor for NetScaler appliance restarts or crashes
Syslog
| where TimeGenerated > ago(7d)
| where Computer contains "netscaler" or Computer contains "ns"
| where SyslogMessage contains "restart" or SyslogMessage contains "crash" or SyslogMessage contains "panic" or SyslogMessage contains "core dump"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

// Hunt for configuration file access on NetScaler systems
Syslog
| where TimeGenerated > ago(24h)
| where Computer contains "netscaler" or Computer contains "ns"
| where SyslogMessage contains "/nsconfig/ns.conf" or SyslogMessage contains "/etc/passwd" or SyslogMessage contains "/etc/shadow"
| where Facility == "authpriv" or Facility == "local0"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

-- Hunt for suspicious processes and network connections on NetScaler appliances
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       netstat.LocalIP, netstat.LocalPort, netstat.RemoteIP, netstat.RemotePort, netstat.State
FROM pslist()
LEFT JOIN netstat() ON pslist.Pid = netstat.Pid
WHERE CommandLine =~ '(sh|bash|python|perl|curl|wget|nc|netcat)'
  AND NOT CommandLine =~ '(/netscaler/|/nsconfig/)'
ORDER BY CreateTime DESC

-- Check for unauthorized configuration file modifications
SELECT * FROM glob(globs=['/nsconfig/ns.conf', '/etc/passwd', '/etc/shadow'])
WHERE Mtime > '2026-11-01'
ORDER BY Mtime DESC

-- Monitor for unusual network connections from NetScaler
SELECT * FROM netstat()
WHERE State == 'ESTABLISHED'
  AND (RemoteIP =~ '^(?!10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.).*')
  AND LocalPort in (80, 443, 22, 21)
ORDER BY Pid

#!/bin/bash
# Citrix NetScaler CVE-2026-120868 Verification and Hardening Script
# Run with appropriate privileges on NetScaler appliance or management station

echo "=== NetScaler Security Verification Script ==="
echo "CVE-2026-120868 and Related Vulnerabilities"
echo "Date: $(date)"
echo ""

# Check current NetScaler version
echo "[+] Checking NetScaler version..."
ns_version=$(nsconmsg -d stats | grep -i version | head -1)
echo "Current version: $ns_version"

# Check if vulnerable version
echo "[+] Checking for vulnerable versions..."
if echo "$ns_version" | grep -E "(13\.1|13\.0|12\.1|12\.0)"; then
    echo "[!] WARNING: Potentially vulnerable version detected"
    echo "[!] IMMEDIATE ACTION REQUIRED: Apply Citrix security updates"
else
    echo "[+] Version appears current, verify against Citrix advisory"
fi

# Check for suspicious processes
echo "[+] Checking for suspicious processes..."
suspicious_procs=$(ps aux | grep -E '(nc|netcat|python|perl|bash|sh)' | grep -v grep | grep -v "/netscaler/")
if [ -n "$suspicious_procs" ]; then
    echo "[!] Suspicious processes detected:"
    echo "$suspicious_procs"
    echo "[!] Investigate immediately"
else
    echo "[+] No obvious suspicious processes found"
fi

# Check configuration file integrity
echo "[+] Checking configuration file integrity..."
config_files="/nsconfig/ns.conf /etc/passwd /etc/shadow"
for file in $config_files; do
    if [ -f "$file" ]; then
        file_mtime=$(stat -c %Y "$file" 2>/dev/null || stat -f %m "$file")
        current_time=$(date +%s)
        days_old=$(( (current_time - file_mtime) / 86400 ))
        if [ $days_old -lt 7 ]; then
            echo "[!] Recently modified: $file ($days_old days ago)"
        fi
    fi
done

# Check for unusual network connections
echo "[+] Checking network connections..."
netstat -an | grep ESTABLISHED | grep -E ":(22|80|443|21)" | grep -v "127.0.0.1"

# Check system logs for errors
echo "[+] Checking recent system logs..."
if [ -f "/var/log/ns.log" ]; then
    echo "Recent errors in ns.log:"
    tail -100 /var/log/ns.log | grep -i "error\|fail\|deny\|attack" | tail -10
fi

# Hardening recommendations
echo ""
echo "=== IMMEDIATE ACTIONS REQUIRED ==="
echo "1. Apply Citrix security updates immediately"
echo "2. Review Citrix advisory: https://support.citrix.com/article/CTX694986"
echo "3. Enable enhanced logging and monitoring"
echo "4. Restrict management interface access"
echo "5. Review and rotate administrative credentials"
echo "6. Enable multi-factor authentication if not already configured"
echo ""
echo "=== HARDENING RECOMMENDATIONS ==="
echo "- Implement network segmentation for management interfaces"
echo "- Enable SNMPv3 with authentication and encryption"
echo "- Regularly backup and verify configuration files"
echo "- Monitor for unauthorized configuration changes"
echo "- Implement intrusion detection on NetScaler traffic"
echo ""
echo "Script completed. Review findings above and take immediate action."