High severityNVD Advisory· Published Mar 23, 2026· Updated May 10, 2026

CVE-2026-4368

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Affected products

Citrix Systems/Netscalerllm-fuzzy
Citrix Systems/Access Gatewayllm-fuzzy
Netscaler/ADCcpe-rescue
Range: 14.1.66.54
NetScaler/Gatewayv5
Range: 14.1.66.54

Patches

Vulnerability mechanics

References

support.citrix.com/support-home/kbsearch/articlenvd

News mentions

30th March – Threat Intelligence Report
Check Point Research · Mar 30, 2026
Citrix Urges Immediate Patching for Critical NetScaler Vulnerabilities
Infosecurity Magazine · Mar 24, 2026

cvss	0.455
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000