Citrix Issues Urgent Patches for Critical NetScaler ADC and Gateway Memory Overread Vulnerabilities
TL;DR
If you’re running NetScaler ADC or Gateway appliances, stop what you’re doing and check your version numbers. Citrix just dropped a set of patches for two nasty vulnerabilities that, frankly, you don’t want to leave unpatched.
The headliner here is CVE-2026-3055. It’s an out-of-bounds read vulnerability that snagged a CVSS score of 9.3—putting it firmly in the "critical" category. In plain English? It allows an unauthenticated, remote attacker to reach into the memory of an appliance configured as a SAML Identity Provider (IdP) and leak sensitive data. We’re talking about active session tokens, user credentials, and internal configuration details. If an attacker gets their hands on those, your perimeter security effectively evaporates.
Then there’s the second issue: CVE-2026-4368. It’s a race condition carrying a 7.7 severity score. It’s not quite as flashy as the memory leak, but it’s just as problematic. On appliances acting as a Gateway or AAA virtual server, this flaw can cause the system to mix up user sessions. One user ends up with another’s access, which is a nightmare for data privacy and unauthorized access control.
The Technical Reality
The mechanics behind CVE-2026-3055 are particularly concerning. When your appliance is acting as a SAML IdP, it’s supposed to be a gatekeeper. Instead, this vulnerability turns it into a leaky faucet. Detailed analysis from Hadrian confirms that the out-of-bounds read allows attackers to scrape memory contents that should be strictly off-limits.
The race condition in CVE-2026-4368 is a different beast entirely. It’s all about timing. By triggering the vulnerability, an attacker can trick the system into misassociating sessions. If you’re a Gateway or AAA user, this means your session-specific data might be exposed to someone else on the network.
According to CERT-EU, there’s no smoking gun yet—no evidence that these are being actively exploited in the wild. But don’t let that lull you into a false sense of security. These are the kinds of bugs that attract researchers and threat actors alike, and once a proof-of-concept hits the web, the window for a "quiet" patch cycle slams shut.
Who Needs to Patch?
Citrix has already scrubbed their managed cloud instances, so if you’re in their cloud, you’re likely in the clear. For everyone else managing their own NetScaler ADC and Gateway hardware or virtual instances, the responsibility is entirely on you. You need to verify your build immediately.
| CVE Identifier | Severity (CVSS) | Vulnerability Type | Primary Impact |
|---|---|---|---|
| CVE-2026-3055 | 9.3 (Critical) | Out-of-bounds Read | Sensitive Information Leakage |
| CVE-2026-4368 | 7.7 (High) | Race Condition | User Session Mix-up |
If you are running anything older than the following versions, you are vulnerable:
- NetScaler ADC and Gateway 14.1: Versions prior to 14.1-66.59
- NetScaler ADC and Gateway 13.1: Versions prior to 13.1-62.23
- NetScaler ADC and Gateway 13.1 (FIPS/NDcPP): Versions prior to 13.1-37.262
The Cleanup Plan
Patching is only the first step. Because the memory overread vulnerability targets session data, simply applying the update doesn't automatically wipe the slate clean. If a token was compromised before you patched, it might still be valid.
Here is how you should handle the remediation process:
- Patch First: Get those updates installed immediately. Don't wait for the weekend.
- Nuke the Sessions: Once the patch is live, force a termination of all active user sessions. It’s a bit of a headache for your users, but it’s the only way to ensure that potentially exposed tokens are rendered useless.
- Audit SAML: Since CVE-2026-3055 is tied to SAML IdP, take a moment to review your SAML configurations. Ensure your appliance isn't exposed to traffic it doesn't need to see.
- Watch the Logs: Keep a close eye on your authentication logs. Look for anything that looks like a session anomaly or an unexpected login pattern.
You can find the full technical documentation and the specific patch files at the Citrix Support portal.
Why This Matters
NetScaler appliances are the front door to your enterprise network. When they are compromised, the entire house is at risk. These vulnerabilities highlight how fragile perimeter security can be when the software managing your identity and access control has a flaw.
The combination of a critical memory leak and a session mix-up is a reminder that "set it and forget it" is a dangerous strategy for network infrastructure. As these devices sit at the edge, they are constant targets. If you aren't maintaining a rigorous patch cycle, you’re essentially leaving the door unlocked.
Think about the broader implications: if your SAML IdP is compromised, an attacker isn't just looking at a single application—they’re looking at the keys to your entire kingdom. They could bypass secondary authentication and move laterally through your network before you even realize something is wrong.
While the current lack of active exploitation is a stroke of luck, don't count on it lasting. Automated scanning tools are likely already being tuned to look for these specific version numbers. Security teams should treat this as a high-priority task. Get the patches, clear the sessions, and verify your configurations. Your network depends on it.
