High severity · published Mar 23, 2026
CVE-2026-4368
Race Condition leading to User Session Mixup
7.7
CVSS
3.4%
EPSS
No
On KEV
Description
Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
ADC · NetScaler
14.1.66.54 · source: vendor
GA
Gateway · NetScaler
14.1.66.54 · source: vendor
In the news
VulnerabilityCritical
Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks
Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could be exploited to leak sensitive data from the application.
The vulnerabilities are listed below -
CVE-2026-3055 (CVSS score: 9.3) - Insufficient input validation leading to memory overread
CVE-2026-4368 (CVSS score: 7.7) - Race condition leading to user
Mar 24, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4368
support.citrix.com
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
More from ADC
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
9.8
CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service