**Critical Alert: Citrix Issues Urgent Patching Advisory for NetScaler Vulnerabilities**

Citrix has released a critical security bulletin warning of two new vulnerabilities in its NetScaler Application Delivery Controller (ADC) and NetScaler Gateway products. These networking and security solutions are widely used by enterprises to manage, optimize, and secure application delivery and remote access. The vulnerabilities, tracked as CVE-2026-3055 and CVE-2026-4368, pose a significant threat to organizations that rely on these products.

The first vulnerability, CVE-2026-3055, is a critical out-of-bounds read with a severity score of 9.3, making it one of the most severe vulnerabilities disclosed in recent times. If exploited, it can enable an unauthenticated remote attacker to leak sensitive information from the appliance's memory. The second vulnerability, CVE-2026-4368, is a race condition flaw with a severity score of 7.7, which can cause session mix-ups if exploited.

**Vulnerability Details**

CVE-2026-3055 affects NetScaler systems explicitly configured as a SAML Identity Provider (SAML IDP). This configuration is typically used for authentication and authorization purposes. According to Citrix's advisory, default or standard configurations remain unaffected by this vulnerability. However, customer-managed instances are vulnerable, while cloud instances managed by Citrix are not affected.

To determine if an appliance is configured as a SAML IDP Profile, customers can inspect their NetScaler Configuration for the specified string: “add authentication samlIdPProfile .*.” If the configuration matches this string, it is likely that the appliance is vulnerable to CVE-2026-3055.

**Mitigation and Patching**

Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. The company has released updates for NetScaler ADC and NetScaler Gateway version 14.1-60.52 and 14.1-66.59, which address both vulnerabilities. Additionally, Citrix has introduced a new feature called Global Deny List, which allows administrators to quickly protect their NetScaler appliances without requiring a reboot.

To mitigate CVE-2026-3055, customers can use the Global Deny List feature by installing the relevant signatures from the NetScaler Console (Console On-prem with Cloud Connect or Console Service). However, it is recommended that customers adopt fully patched builds as explained above. The Global Deny List feature is intended to be a temporary solution until upgrades can be performed during a scheduled outage window.

**No Known Exploitation**

Fortunately, there is no known in-the-wild exploitation of these vulnerabilities, and no public proof-of-concept (PoC) exploit is available at the time of writing. However, it is essential for organizations to take immediate action to patch their NetScaler appliances and mitigate any potential threats.

**Conclusion**

The discovery of critical vulnerabilities in Citrix's NetScaler products highlights the importance of regular security updates and patches. Organizations that rely on these products must take prompt action to address these vulnerabilities and prevent any potential data breaches or compromises. By staying informed about the latest cybersecurity threats and taking proactive measures, organizations can minimize their risk and ensure a secure online environment.

**Recommendations**

* Immediate patching: Affected customers should install the relevant updated versions as soon as possible. * Mitigation via Global Deny List: Customers can use the Global Deny List feature to temporarily protect their NetScaler appliances until upgrades can be performed during a scheduled outage window. * Regular security updates: Organizations must stay up-to-date with the latest security patches and updates for their NetScaler products.

By taking these steps, organizations can ensure the security of their applications and data and prevent potential cyber threats.