Vulnerability-Lookup

WID-SEC-W-2026-0836

Vulnerability from csaf_certbund - Published: 2026-03-23 23:00 - Updated: 2026-03-29 22:00

Summary

Citrix Systems NetScaler: Mehrere Schwachstellen

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Citrix NetScaler ist eine integrierte Lösung für die Beschleunigung, das Traffic Management und die Sicherheit von Web-Applikationen. Citrix Access Gateway ist ein universell einsetzbares SSL-VPN. Advanced Access Control (AAC) ermöglichen es Administratoren, Zugriffsregeln für das Access Gateway festzulegen.

Angriff: Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Citrix Systems NetScaler ausnutzen, um Informationen offenzulegen und um eine Benutzersitzung zu übernehmen.

Betroffene Betriebssysteme: - Appliance

CVE-2026-3055

Affected products

Known affected 6 products

Product	Identifier	Version	Remediation
Citrix Systems NetScaler ADC NDcPP <13.1-37.262 Citrix Systems / NetScaler		ADC NDcPP <13.1-37.262
Citrix Systems NetScaler Gateway <13.1-62.23 Citrix Systems / NetScaler		Gateway <13.1-62.23
Citrix Systems NetScaler ADC FIPS <13.1-37.262 Citrix Systems / NetScaler		ADC FIPS <13.1-37.262
Citrix Systems NetScaler Gateway <14.1-66.59 Citrix Systems / NetScaler		Gateway <14.1-66.59
Citrix Systems NetScaler ADC <13.1-62.23 Citrix Systems / NetScaler		ADC <13.1-62.23
Citrix Systems NetScaler ADC <14.1-66.59 Citrix Systems / NetScaler		ADC <14.1-66.59

CVE-2026-4368

Affected products

Known affected 6 products

Product	Identifier	Version	Remediation
Citrix Systems NetScaler ADC NDcPP <13.1-37.262 Citrix Systems / NetScaler		ADC NDcPP <13.1-37.262
Citrix Systems NetScaler Gateway <13.1-62.23 Citrix Systems / NetScaler		Gateway <13.1-62.23
Citrix Systems NetScaler ADC FIPS <13.1-37.262 Citrix Systems / NetScaler		ADC FIPS <13.1-37.262
Citrix Systems NetScaler Gateway <14.1-66.59 Citrix Systems / NetScaler		Gateway <14.1-66.59
Citrix Systems NetScaler ADC <13.1-62.23 Citrix Systems / NetScaler		ADC <13.1-62.23
Citrix Systems NetScaler ADC <14.1-66.59 Citrix Systems / NetScaler		ADC <14.1-66.59

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.citrix.com/support-home/kbsearch/…	external
https://community.citrix.com/techzone-blogs/110_s…	external
https://cert.europa.eu/publications/security-advi…	external
https://labs.watchtowr.com/please-we-beg-just-one…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Citrix NetScaler ist eine integrierte L\u00f6sung f\u00fcr die Beschleunigung, das Traffic Management und die Sicherheit von Web-Applikationen. Citrix Access Gateway ist ein universell einsetzbares SSL-VPN. Advanced Access Control (AAC) erm\u00f6glichen es Administratoren, Zugriffsregeln f\u00fcr das Access Gateway festzulegen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Citrix Systems NetScaler ausnutzen, um Informationen offenzulegen und um eine Benutzersitzung zu \u00fcbernehmen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0836 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0836.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0836 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0836"
      },
      {
        "category": "external",
        "summary": "Citrix Security Bulletin CTX696300 vom 2026-03-23",
        "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300"
      },
      {
        "category": "external",
        "summary": "Citrix Tech Zone Blog vom 2026-03-23",
        "url": "https://community.citrix.com/techzone-blogs/110_security-updates/critical-and-high-severity-updates-announced-for-netscaler-gateway-and-netscaler-adc-r1256/"
      },
      {
        "category": "external",
        "summary": "CERT-EU Security Advisory 2026-003 vom 2026-03-23",
        "url": "https://cert.europa.eu/publications/security-advisories/2026-003/"
      },
      {
        "category": "external",
        "summary": "WatchTower Labs Report vom 2026-03-29",
        "url": "https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/"
      }
    ],
    "source_lang": "en-US",
    "title": "Citrix Systems NetScaler: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-29T22:00:00.000+00:00",
      "generator": {
        "date": "2026-03-30T07:19:10.885+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0836",
      "initial_release_date": "2026-03-23T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-23T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-29T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-2026-3055 wird ausgenutzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "ADC \u003c14.1-66.59",
                "product": {
                  "name": "Citrix Systems NetScaler ADC \u003c14.1-66.59",
                  "product_id": "T052060"
                }
              },
              {
                "category": "product_version",
                "name": "ADC 14.1-66.59",
                "product": {
                  "name": "Citrix Systems NetScaler ADC 14.1-66.59",
                  "product_id": "T052060-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:adc__14.1-66.59"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway \u003c14.1-66.59",
                "product": {
                  "name": "Citrix Systems NetScaler Gateway \u003c14.1-66.59",
                  "product_id": "T052061"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway 14.1-66.59",
                "product": {
                  "name": "Citrix Systems NetScaler Gateway 14.1-66.59",
                  "product_id": "T052061-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:gateway__14.1-66.59"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ADC \u003c13.1-62.23",
                "product": {
                  "name": "Citrix Systems NetScaler ADC \u003c13.1-62.23",
                  "product_id": "T052062"
                }
              },
              {
                "category": "product_version",
                "name": "ADC 13.1-62.23",
                "product": {
                  "name": "Citrix Systems NetScaler ADC 13.1-62.23",
                  "product_id": "T052062-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:adc__13.1-62.23"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Gateway \u003c13.1-62.23",
                "product": {
                  "name": "Citrix Systems NetScaler Gateway \u003c13.1-62.23",
                  "product_id": "T052063"
                }
              },
              {
                "category": "product_version",
                "name": "Gateway 13.1-62.23",
                "product": {
                  "name": "Citrix Systems NetScaler Gateway 13.1-62.23",
                  "product_id": "T052063-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:gateway__13.1-62.23"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ADC FIPS \u003c13.1-37.262",
                "product": {
                  "name": "Citrix Systems NetScaler ADC FIPS \u003c13.1-37.262",
                  "product_id": "T052064"
                }
              },
              {
                "category": "product_version",
                "name": "ADC FIPS 13.1-37.262",
                "product": {
                  "name": "Citrix Systems NetScaler ADC FIPS 13.1-37.262",
                  "product_id": "T052064-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:adc_fips__13.1-37.262"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ADC NDcPP \u003c13.1-37.262",
                "product": {
                  "name": "Citrix Systems NetScaler ADC NDcPP \u003c13.1-37.262",
                  "product_id": "T052065"
                }
              },
              {
                "category": "product_version",
                "name": "ADC NDcPP 13.1-37.262",
                "product": {
                  "name": "Citrix Systems NetScaler ADC NDcPP 13.1-37.262",
                  "product_id": "T052065-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:netscaler:adc_ndcpp__13.1-37.262"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "NetScaler"
          }
        ],
        "category": "vendor",
        "name": "Citrix Systems"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3055",
      "product_status": {
        "known_affected": [
          "T052065",
          "T052063",
          "T052064",
          "T052061",
          "T052062",
          "T052060"
        ]
      },
      "release_date": "2026-03-23T23:00:00.000+00:00",
      "title": "CVE-2026-3055"
    },
    {
      "cve": "CVE-2026-4368",
      "product_status": {
        "known_affected": [
          "T052065",
          "T052063",
          "T052064",
          "T052061",
          "T052062",
          "T052060"
        ]
      },
      "release_date": "2026-03-23T23:00:00.000+00:00",
      "title": "CVE-2026-4368"
    }
  ]
}

CVE-2026-3055 (GCVE-0-2026-3055)

Vulnerability from cvelistv5 – Published: 2026-03-23 20:21 – Updated: 2026-03-31 03:55

Title

Insufficient input validation leading to memory overread

Summary

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

NetScaler

References

3 references

URL	Tags
https://support.citrix.com/support-home/kbsearch/…
https://labs.watchtowr.com/please-we-beg-just-one…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

2 products

Vendor	Product	Version
NetScaler	ADC	Affected: 14.1 , < 66.59 (patch) Affected: 13.1 , < 62.23 (patch) Affected: 13.1 FIPS and NDcPP , < 37.262 (patch)
NetScaler	Gateway	Affected: 14.1 , < 66.59 (patch) Affected: 13.1 , < 62.23 (patch)

Date Public

2026-03-23 19:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3055",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-03-30",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T03:55:32.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-03-30T00:00:00.000Z",
            "value": "CVE-2026-3055 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ADC",
          "vendor": "NetScaler",
          "versions": [
            {
              "lessThan": "66.59",
              "status": "affected",
              "version": "14.1",
              "versionType": "patch"
            },
            {
              "lessThan": "62.23",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            },
            {
              "lessThan": "37.262",
              "status": "affected",
              "version": "13.1 FIPS and NDcPP",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gateway",
          "vendor": "NetScaler",
          "versions": [
            {
              "lessThan": "66.59",
              "status": "affected",
              "version": "14.1",
              "versionType": "patch"
            },
            {
              "lessThan": "62.23",
              "status": "affected",
              "version": "13.1",
              "versionType": "patch"
            }
          ]
        }
      ],
      "datePublic": "2026-03-23T19:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient input validation in\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNetScaler ADC and NetScaler Gateway when\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;configured as a SAML IDP\u0026nbsp;\u003c/span\u003eleading to\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;memory overread\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient input validation in\u00a0NetScaler ADC and NetScaler Gateway when\u00a0configured as a SAML IDP\u00a0leading to\u00a0memory overread"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T20:21:27.107Z",
        "orgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
        "shortName": "NetScaler"
      },
      "references": [
        {
          "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient input validation leading to memory overread",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
    "assignerShortName": "NetScaler",
    "cveId": "CVE-2026-3055",
    "datePublished": "2026-03-23T20:21:27.107Z",
    "dateReserved": "2026-02-23T18:00:08.900Z",
    "dateUpdated": "2026-03-31T03:55:32.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4368 (GCVE-0-2026-4368)

Vulnerability from cvelistv5 – Published: 2026-03-23 20:09 – Updated: 2026-05-10 13:00

Title

Race Condition leading to User Session Mixup

Summary

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

NetScaler

References

1 reference

URL	Tags
https://support.citrix.com/support-home/kbsearch/…

Impacted products

2 products

Vendor	Product	Version
NetScaler	ADC	Affected: 14.1.66.54 (patch)
NetScaler	Gateway	Affected: 14.1.66.54

Date Public

2026-03-23 20:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4368",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T03:56:06.911644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-10T13:00:44.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ADC",
          "vendor": "NetScaler",
          "versions": [
            {
              "status": "affected",
              "version": "14.1.66.54",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Gateway",
          "vendor": "NetScaler",
          "versions": [
            {
              "status": "affected",
              "version": "14.1.66.54"
            }
          ]
        }
      ],
      "datePublic": "2026-03-23T20:02:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eRace Condition in\u0026nbsp;\u003c/span\u003e\u003cspan\u003eNetScaler ADC and NetScaler Gateway when a\u003c/span\u003e\u003cspan\u003eppliance is configured as\u0026nbsp;\u003c/span\u003e\u003cspan\u003eGateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eAAA virtual server\u003c/span\u003e\u003cspan\u003e\u0026nbsp;leading to User Session Mixup\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Race Condition in\u00a0NetScaler ADC and NetScaler Gateway when appliance is configured as\u00a0Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or\u00a0AAA virtual server\u00a0leading to User Session Mixup"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T20:09:44.971Z",
        "orgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
        "shortName": "NetScaler"
      },
      "references": [
        {
          "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Race Condition leading to User Session Mixup",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
    "assignerShortName": "NetScaler",
    "cveId": "CVE-2026-4368",
    "datePublished": "2026-03-23T20:09:44.971Z",
    "dateReserved": "2026-03-18T05:23:50.518Z",
    "dateUpdated": "2026-05-10T13:00:44.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-0836

CVE-2026-3055 (GCVE-0-2026-3055)

CVE-2026-4368 (GCVE-0-2026-4368)

Tags

Sightings

Nomenclature