Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks

Citrix has released security updates for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical memory leak flaw.

• •CVE-2026-3055 (CVSS 9.3): an out-of-bounds memory read exploitable by unauthenticated remote attackers, but only when the appliance is configured as a SAML Identity Provider
• •CVE-2026-4368 (CVSS 7.7): a race condition causing user session mixup, affecting devices configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA server
• •Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-66.59 and 13.1 before 13.1-62.23
• •No active exploitation has been confirmed yet, but NetScaler devices have a history of being targeted (Citrix Bleed, Citrix Bleed 2)
• •Security experts warn that imminent exploitation is highly likely and urge immediate patching