Search threats, CVEs… ⌘K
← Back to CVE intelligence
CVE intelligence

CVE-2026-4368

Vulnerability intelligence

Published Mar 23, 2026Sources checked Oct 27, 2026
7.7HIGHCVSS out of 10
What this means

Review the available evidence

CVE-2026-4368 and is rated High severity with a CVSS score of 7.7. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Citrix Security Bulletins guidance

Vendor revision: Oct 3, 2026
Vendor remediation details

CVE 2026-3055 was identified internally through our ongoing security reviews and broader efforts to strengthen the security of the product. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. NetScaler ADC and NetScaler Gateway 14.1-60.58 NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1 NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.262 and later releases of 13.1-FIPS and 13.1-NDcPP Note: Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities. CVE-2026-3055 : Customers can determine if they have an appliance configured as a SAML IDP Profile by inspecting their NetScaler Configuration for the specified string: add authentication samlIdPProfile .* CVE-2026-4368 Customers can determine if they have an appliance configured as one of the following by inspecting their NetScaler Configuration for the specified strings An Auth Server (AAA Vserver): add authentication vserver .* A Gateway (VPN Vserver, ICA Proxy, CVPN, RDP Proxy) : add vpn vserver .* The information on this page is being provided to you on an "AS IS" and "AS-AVAILABLE" basis. The issues described on this page may or may not impact your system(s). Cloud Software Group Holdings, Inc. and its subsidiaries (collectively, "Cloud SG") make no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE ARE HEREBY DISCLAIMED. BY ACCESSING THIS PAG

Vendor-listed releases

  • NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases
  • NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.262 and later releases of 13.1-FIPS and 13.1-NDcPP
CISA KEVNot listedBased on the latest collected catalog
EPSS3.4%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview

What is CVE-2026-4368?

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Source: NVD