cyber.hendryadrian.com
Vulnerability & Exploit · ncsc.gov.uk

Citrix patches two NetScaler ADC and Gateway vulnerabilities

· Original article ↗

Summary

Citrix disclosed two NetScaler ADC and Gateway vulnerabilities affecting specific on-premises versions and configurations. The NCSC recommends updating to fixed releases and checking appliance configurations for exposure.

Key points

  • CVE-2026-3055 is a memory overread affecting appliances configured as a SAML identity provider.
  • CVE-2026-4368 can cause user session mix-ups on specified gateway or AAA virtual server configurations.
  • Affected versions include NetScaler ADC and Gateway 14.1 and 13.1 releases before the listed fixed versions; CVE-2026-4368 affects 14.1-66.54.
  • Citrix released fixes including 14.1-66.59 and 13.1-62.23, with corresponding FIPS and NDcPP updates.
  • The vendor says only customer-managed instances require remediation. Configuration checks are provided to help identify potentially affected appliances.

Article Details

Vulnerability Types
  • Insufficient input validation causing memory overread
  • Race condition causing user session mixup
Affected Versions
  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-66.59
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-62.23
  • NetScaler ADC FIPS and NDcPP before 13.1-37.262
  • NetScaler ADC and NetScaler Gateway 14.1-66.54
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-3055CVE-2026-3055: Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overreadCVE-2026-4368CVE-2026-4368: Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup 

Vendors

CitrixCitrix has published a security bulletin detailing two vulnerabilities discovered in its NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) products:

Products

NetScaler ADCCitrix has published a security bulletin detailing two vulnerabilities discovered in its NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) products:NetScaler GatewayCitrix has published a security bulletin detailing two vulnerabilities discovered in its NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) products:

Related Articles