Citrix patches critical NetScaler bleed-like flaws (CVE-2026-3055, CVE-2026-4368)

Photo by protect.computer (custom explainer graphic) on protect.computer

What happened

Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix two important vulnerabilities:

• CVE-2026-3055 (critical): insufficient input validation that can cause a memory overread and potentially leak sensitive data.
• CVE-2026-4368 (high): a race condition that can cause user session mix-up in specific gateway/AAA setups.

Citrix says customers should patch as soon as possible. Security researchers have warned this issue looks similar to previous “CitrixBleed”-style bugs that were heavily exploited after disclosure.

Why this matters

NetScaler is widely used for remote access and authentication. If exploited on vulnerable configurations, attackers could steal sensitive session data or interfere with user sessions.

Even without confirmed widespread exploitation at publication time, these flaws are high-priority because:

• NetScaler devices are often internet-facing.
• Similar flaws were weaponized quickly in prior incidents.
• Attackers can reverse-engineer patches to build exploits.

How to check if you’re affected

Potentially affected systems/services

• NetScaler ADC and NetScaler Gateway before 14.1-66.59.
• NetScaler ADC and NetScaler Gateway before 13.1-62.23.
• NetScaler ADC 13.1-FIPS / 13.1-NDcPP before 13.1-37.262.
• Higher risk if configured as:
  • SAML Identity Provider (relevant to CVE-2026-3055)
  • Gateway or AAA virtual server (relevant to CVE-2026-4368)

Quick verification steps

1. Check your installed version/build

   • Confirm whether your appliance is below any fixed versions listed above.

2. Check vulnerable feature exposure

   • Review configuration for SAML IdP profiles and Gateway/AAA virtual server usage.

3. Prioritize exposed assets

   • Patch internet-facing NetScaler instances first, then internal appliances.

4. Apply Citrix updates immediately

   • Move to fixed builds and validate service health after patching.

5. Watch for suspicious behavior

   • Investigate unusual authentication/session anomalies after update windows.

Immediate defensive actions

• Emergency-patch vulnerable NetScaler appliances.
• Restrict management and gateway access paths until patching is complete.
• Add temporary heightened monitoring for authentication/session anomalies.
• Document patched versions per instance for rapid audit readiness.

Sources

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300 (primary source)
• https://community.citrix.com/techzone-blogs/110_security-updates/critical-and-high-severity-updates-announced-for-netscaler-gateway-and-netscaler-adc-r1256/
• https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-netscaler-flaws-as-soon-as-possible/
• https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/

Bottom line

If you run NetScaler, treat these updates as urgent. Confirm whether your deployment uses SAML IdP or Gateway/AAA roles, patch immediately, and verify session/authentication behavior after rollout.