What is CVE-2026-4368?
Race condition vulnerability (CWE-362) in Citrix NetScaler ADC and NetScaler Gateway when configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Under specific timing conditions during concurrent user authentication, the race condition causes one user's authenticated session context to be incorrectly associated with another user, enabling session hijacking and unauthorized access to another user's resources. Disclosed alongside CVE-2026-3055 (pre-auth memory overread, CVSS 9.3) in Citrix security bulletin CTX696300 on March 23, 2026. Only affects build 14.1-66.54 specifically and requires low privileges and precise timing to exploit. Part of the CitrixBleed vulnerability family — predecessors CVE-2023-4966 and CVE-2025-5777 saw rapid weaponization by ransomware groups including LockBit and APT Salt Typhoon. Shadowserver reports over 30,000 NetScaler ADC instances exposed to the internet. Patched in versions 14.1-66.59, 13.1-62.23, and 13.1-37.262 (FIPS/NDcPP). Cloud-managed instances are not affected.
The record classifies CVE-2026-4368 under weakness class CWE-362. 2 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 221 days ago.
Severity and exploitation probability
- CVSS v4.0 base score
- 7.7
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - EPSS (FIRST)
- 0.2% probability of exploitation in the next 30 days, higher than 20.3% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 4.7/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-03-23, last modified 2026-05-10
Is CVE-2026-4368 being exploited?
It currently carries a trending score of 20 in the Threadlinqs vulnerability feed.
Affected products and versions
- Citrix: Netscaler Adc 14.1-66.54, Netscaler Gateway 14.1-66.54
How to fix CVE-2026-4368
The record marks a vendor fix as available for CVE-2026-4368. Patch reference: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300. Vendor advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-4368
5 tracked threats in the Threadlinqs corpus reference CVE-2026-4368, either in the campaign’s CVE list or as an indicator on the campaign record.
- Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772) — CRITICAL · 2026-09-27
- CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation — CRITICAL · 2026-06-30
- CitrixBleed 3 — CVE-2026-3055 & CVE-2026-4368 NetScaler ADC/Gateway Memory Overread and Session Hijack — CRITICAL · 2026-04-17
- CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Pre-Auth Memory Overread and Session Mixup — CRITICAL · 2026-03-28
- CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Unauthenticated Memory Disclosure and Session Hijacking — CRITICAL · 2026-03-24
Sources
Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories. Last verified by Threadlinqs on .