Which versions of Citrix are affected by CVE-2026-4368?

Organizations using Race Condition in NetScaler ADC and NetScaler Gateway when appliance face notable risk from CVE-2026-4368 rated CVSS 7.7.

How to fix or mitigate CVE-2026-4368?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Citrix CVE-2026-4368

Q: What is the CVSS score of CVE-2026-4368?

CVE-2026-4368 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14547 HIGH

Race Condition (CWE-362)

2026-03-23 NetScaler

GHSA-445m-jc4j-p5gf

Citrix Race Condition Information Disclosure

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 20:30 euvd

EUVD-2026-14547

Analysis Generated

Mar 23, 2026 - 20:30 vuln.today

CVE Published

Mar 23, 2026 - 20:09 nvd

HIGH 7.7

DescriptionCVE.org

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

AnalysisAI

Citrix NetScaler ADC and Gateway instances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers are vulnerable to a race condition that enables authenticated attackers to hijack other users' sessions. An attacker with valid credentials can exploit timing-dependent conditions to cause session mixup between concurrent users, potentially gaining unauthorized access to sensitive resources or impersonating other authenticated users. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

The vulnerability is rooted in a classic race condition (CWE category related to concurrent access to shared resources without proper synchronization) within NetScaler's session management infrastructure. The affected products include NetScaler ADC (cpe:2.3:a:netscaler:adc:*:*:*:*:*:*:*:*) and NetScaler Gateway (cpe:2.3:a:netscaler:gateway:*:*:*:*:*:*:*:*), which are reverse proxy and secure access appliances commonly deployed as SSL VPN gateways, ICA Proxy servers, Clientless VPN (CVPN) endpoints, RDP proxies, and AAA virtual servers. When multiple concurrent user sessions are processed by the appliance, improper synchronization of session state management allows a timing-dependent condition where session identifiers or authentication contexts can be incorrectly assigned or shared between different user connections. This is particularly critical in gateway deployments where the appliance acts as a trust boundary between untrusted networks and internal resources.

RemediationAI

Consult Citrix security advisory CTX696300 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300) for patched versions and upgrade NetScaler ADC and NetScaler Gateway to the recommended fixed release immediately. As interim mitigations pending patch deployment, consider reducing concurrent user session load through connection limits, implementing network-level access controls to restrict gateway access to known-good sources only, and enabling enhanced session monitoring and logging to detect anomalous session access patterns. Citrix may recommend appliance-level configuration hardening such as disabling unused protocols (CVPN, ICA Proxy, RDP Proxy if not required) to reduce attack surface until patches can be applied.