Citrix NetScaler ADC & Gateway Hit by Dual CVEs: Out‑of‑Bounds Read & Session Mix‑Up

On March 23 2026, Citrix published a security advisory exposing two serious vulnerabilities that affect both NetScaler ADC and NetScaler Gateway. The flaws can expose sensitive data or let an attacker hijack another user’s session under specific configurations.

What’s at stake?

• CVE‑2026‑3055 – an out‑of‑bounds read that can leak memory contents. It targets systems configured as a SAML Identity Provider (IdP) and carries a CVSS score of 9.3.
• CVE‑2026‑4368 – a race condition that can cause user session mix‑up. It affects Gateway‑type services (SSL VPN, ICA Proxy, CVPN, RDP proxy) and AAA virtual servers, with a CVSS score of 7.7.

Technical Breakdown

The first flaw allows an attacker to read beyond the intended buffer, potentially exposing confidential data stored in memory. The second flaw races two processes that manage session state, enabling one user to take over another’s session token.

Affected Products

• NetScaler ADC – versions prior to 14.1‑66.59, 13.1‑62.23, and 13.1‑37.262 (FIPS and NDcPP).
• NetScaler Gateway – same version thresholds as ADC.
• Known STA server binding issue in builds 14.1‑66.54 and 14.1‑66.59 that can break authentication flows when the full path is used.

Mitigation Steps

• Restrict inbound access to NetScaler Gateway and AAA virtual servers using IP allow‑listing or firewall rules until patches are applied.
• Deploy the Global Deny List (GDL) mitigation if available – it can block the attacks without requiring a reboot.
• Identify all internet‑facing appliances configured as SAML IdP, Gateway, or AAA and prioritize them for remediation.
• Take snapshots of the appliances before applying updates; these may be needed for forensic analysis.
• Apply the latest security patches from Citrix as soon as possible.
• After patching, terminate all active sessions to prevent reuse of potentially compromised tokens. Use the following commands on the appliance:
  • kill aaa session -all
  • kill icaconnection -all
  • kill rdp connection -all
  • kill pcoipConnection -all
  • clear lb persistentSessions

"No public evidence of exploitation has been reported, but the severity of the bugs warrants immediate action," said the CERT‑EU advisory.

Citrix recommends staying alert for any signs of abnormal activity and keeping logs for a few days after remediation to detect possible attempts.