# CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Pre-Auth Memory Overread and Session Mixup

> Two critical vulnerabilities in Citrix NetScaler ADC and Gateway. CVE-2026-3055 (CVSS 9.3) is a pre-authentication memory overread via insufficient input validation when configured as SAML IDP, enabling unauthenticated remote attackers to read sensitive memory including session tokens and credentials. CVE-2026-4368 (CVSS 7.7) is a race condition causing user session mixup when configured as Gateway or AAA virtual server. NCSC and CERT-EU have urged immediate patching. Over 30,000 instances exposed globally.

- **Published:** 2026-03-28T12:00:00Z
- **Last reviewed:** 2026-07-19T09:24:47.359Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0294
- **ID:** TL-2026-0294
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3055, CVE-2026-4368

## Description

Citrix has disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway that pose significant risk to enterprise network infrastructure worldwide.

CVE-2026-3055 — Pre-Authentication Memory Overread (CVSS 9.3 Critical)

The most severe vulnerability, CVE-2026-3055, is a pre-authentication out-of-bounds read (CWE-125) affecting NetScaler ADC and Gateway appliances configured as SAML Identity Providers (SAML IDP). The vulnerability stems from insufficient input validation in the SAML IDP request processing path. When a NetScaler appliance processes SAML authentication requests, inadequate bounds checking allows a crafted request to cause the appliance to read memory beyond intended buffer boundaries. This enables unauthenticated remote attackers to extract sensitive data from appliance memory, including active session tokens, authentication state data, and potentially user credentials.

The vulnerability requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L), making it highly exploitable. The attack surface is any NetScaler appliance with SAML IDP configured — detectable via the presence of 'add authentication samlIdPProfile' in the appliance configuration. Citrix-managed cloud instances and Adaptive Authentication deployments are NOT affected; only customer-managed instances are vulnerable.

CVE-2026-4368 — Race Condition Session Mixup (CVSS 7.7 High)

The second vulnerability, CVE-2026-4368, is a race condition (CWE-362) affecting NetScaler ADC and Gateway when configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Under specific timing conditions during concurrent user authentication, the race condition causes one user's authenticated session context to be incorrectly associated with another user, enabling session hijacking and unauthorized access to another user's resources. This vulnerability only affects build 14.1-66.54 specifically and requires low privileges and precise timing to exploit.

Historical Context — The CitrixBleed Family

CVE-2026-3055 is the third major memory-read vulnerability in NetScaler's authentication infrastructure, following CitrixBleed (CVE-2023-4966, CVSS 9.4) in 2023 and CitrixBleed2 (CVE-2025-5777, CVSS 9.3) in 2025. Both predecessors saw rapid weaponization — CitrixBleed was exploited by LockBit and multiple APT groups, while CitrixBleed2 was exploited by Salt Typhoon against European telecom infrastructure with over 11.5 million attacks detected. The structural similarity to these predecessors makes rapid exploit development for CVE-2026-3055 highly likely.

Exposure and Impact

Shadowserver reports over 30,000 NetScaler ADC instances and 2,300+ Gateway instances exposed to the internet. Censys estimates approximately 40,000 total affected deployments, while Shodan shows over 56,000 discoverable Citrix NetScaler services. Exposed assets span critical sectors including industrials (22.6%), consumer discretionary (14.1%), financials, healthcare, and information technology.

Patch and Mitigation

Citrix has released patched versions: 14.1-66.59, 13.1-62.23, and 13.1-37.262 (FIPS/NDcPP). A known regression in builds 14.1-66.54 and 14.1-66.59 affects STA server binding when using full paths. Organizations must terminate all active sessions after patching, as leaked session tokens remain valid until explicitly invalidated. Interim mitigations include network-level IP allowlisting and deploying Global Deny List (GDL) signatures available for versions 14.1-60.52 and 14.1-60.57.

The vulnerability was discovered internally by Cloud Software Group through proactive security testing. As of March 28, 2026, no public proof-of-concept exploit exists and no active exploitation has been confirmed, but multiple security firms including Rapid7, Arctic Wolf, and watchTowr assess exploitation as imminent given the low attack complexity and established pattern of rapid weaponization of prior NetScaler vulnerabilities.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1550 Use Alternate Authentication Material
- T1021 Remote Services
- T1563 Remote Service Session Hijacking
- T1005 Data from Local System
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1528 Steal Application Access Token
- T1187 Forced Authentication
- T1040 Network Sniffing
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1020 Automated Exfiltration
- T1531 Account Access Removal
- T1606 Forge Web Credentials
- T1592 Gather Victim Host Information
- T1041 Exfiltration Over C2 Channel
- T1133 External Remote Services
- T1213 Data from Information Repositories

## Sources

- [Citrix Security Bulletin CTX696300](https://support.citrix.com/article/CTX696300)
- [NCSC CTO Weekly Summary - Week Ending March 29th 2026](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-march-09e)
- [NVD - CVE-2026-3055](https://nvd.nist.gov/vuln/detail/CVE-2026-3055)
- [NVD - CVE-2026-4368](https://nvd.nist.gov/vuln/detail/CVE-2026-4368)
- [NCSC UK Advisory - Vulnerabilities Affecting Citrix NetScaler ADC and Gateway](https://www.ncsc.gov.uk/news/vulnerabilities-affecting-citrix-netscaler-adc-gateway)
- [CERT-EU Security Advisory 2026-003](https://cert.europa.eu/publications/security-advisories/2026-003/)
- [Rapid7 ETR: CVE-2026-3055 Citrix NetScaler ADC and Gateway Out-of-Bounds Read](https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/)
- [Arctic Wolf: CVE-2026-3055 Critical NetScaler Vulnerability](https://arcticwolf.com/resources/blog/cve-2026-3055/)
- [Help Net Security: Critical NetScaler Flaw Could Leak Sensitive Data](https://www.helpnetsecurity.com/2026/03/24/netscaler-adc-gateway-cve-2026-3055/)
- [CSO Online: New Critical Citrix NetScaler Hole of Similar Severity to CitrixBleed2](https://www.csoonline.com/article/4150224/new-critical-citrix-netscaler-hole-of-similar-severity-to-citrixbleed2-says-expert.html)
- [CyCognito: Citrix NetScaler ADC and Gateway Vulnerabilities](https://www.cycognito.com/blog/citrix-netscaler-adc-and-gateway-vulnerabilities-cve-2026-3055-cve-2026-4368/)
- [Qualys ThreatPROTECT: Citrix NetScaler Multiple Vulnerabilities](https://threatprotect.qualys.com/2026/03/24/citrix-netscaler-adc-and-netscaler-gateway-multiple-vulnerabilities-cve-2026-3055-cve-2026-4368/)
- [The Hacker News: Citrix Urges Patching Critical NetScaler Vulnerability](https://thehackernews.com/2026/03/citrix-urges-patching-critical.html)
- [BleepingComputer: Citrix Urges Admins to Patch NetScaler Flaws](https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-netscaler-flaws-as-soon-as-possible/)
- [SecurityWeek: Critical Citrix NetScaler Vulnerability Poised for Exploitation](https://www.securityweek.com/critical-citrix-netscaler-vulnerability-poised-for-exploitation-security-firms-warn/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0294