**Critical NetScaler Vulnerabilities Exposed: Urgent Patching Recommended by Citrix**

Citrix has issued a pressing security bulletin to address two newly discovered vulnerabilities in its NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. These critical flaws, tracked as CVE-2026-3055 and CVE-2026-4368, pose significant cybersecurity risks for organizations relying on these products for network management and security.

The first vulnerability, CVE-2026-3055, is a severe out-of-bounds read with a CVSS v4.0 severity score of 9.3. This flaw, identified internally by Citrix's parent company, Cloud Software Group, allows an unauthenticated remote attacker to leak sensitive information from the appliance's memory due to insufficient input validation leading to memory overread.

**Affected Products and Configurations**

The CVE-2026-3055 vulnerability affects NetScaler systems specifically configured as a SAML Identity Provider (SAML IDP). Default or standard configurations remain unaffected. Additionally, only customer-managed instances are affected, not cloud instances managed by Citrix. To determine if an appliance is configured as a SAML IDP Profile, customers can inspect their NetScaler Configuration for the specified string: “add authentication samlIdPProfile .*.”

**Mitigation and Patching**

Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. The recommended patches include:

* NetScaler ADC and NetScaler Gateway version 14.1-60.52 * Cloud Software Group has released Global Deny List signatures for mitigating CVE 2026-3055. * Customers must use NetScaler Console (Console On-prem with Cloud Connect or Console Service) to receive the necessary signatures.

The company also recommends adopting fully patched builds as explained above, and notes that the Global Deny List feature is meant to provide a method of quickly protecting the NetScaler during a scheduled outage window.

**Second Vulnerability: CVE-2026-4368**

A second vulnerability, tracked as CVE-2026-4368, is a race condition flaw with a severity score (CVSS v4.0) of 7.7. If exploited, this flaw can cause session mix up. It affects NetScaler ADC and NetScaler Gateway version 14.1-66.54 if the appliance is configured as one of the following:

* Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) * AAA virtual server

Customers can determine if they have an appliance configured with these settings by inspecting their NetScaler Configuration for the specified strings.

**Actionable Steps**

To ensure the security and integrity of your organization's network, it is crucial to take immediate action:

1. Verify if your NetScaler system is affected by checking the specified configurations. 2. Install the recommended patches or adopt fully patched builds. 3. Utilize Global Deny List signatures for mitigating CVE 2026-3055.

**Conclusion**

The discovery of these critical vulnerabilities in Citrix's NetScaler products highlights the importance of regular security updates and vigilant monitoring of network systems. By taking prompt action to address these flaws, organizations can protect themselves against potential cyber threats and maintain a secure computing environment.