Netscaler CVE-2026-4368

Citrix NetScaler ADC or NetScaler Gateway configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Requires low-privilege authenticated user account. Race condition triggered under specific timing conditions (AT:P). Affects versions prior to security updates addressing this vulnerability.

While CVSS and CVSS vector data are not available for this CVE, the combination of indicators strongly suggests a high real-world risk: the vulnerability affects widely-deployed critical infrastructure (NetScaler ADC/Gateway are enterprise standard gateways), the technical impact is severe (user session mixup can lead to complete authentication bypass and lateral movement), and the attack surface is large (any appliance handling concurrent user connections). The absence of a published CVSS vector prevents quantitative severity assessment, but the qualitative factors indicate this should be treated as a critical priority. The vulnerability is not listed as actively exploited in CISA KEV data based on available intelligence, but the session mixup nature suggests it is not self-reporting (victims may not detect exploitation). No POC is explicitly documented in the available references, reducing immediate exploit probability; however, the race condition class typically has lower exploitation complexity once root cause is understood. Applying SSVC framework: the technical impact is high (authentication/session bypass), automatable (network-accessible appliance), and likely to have public exploitation within 30 days of patch release.

An attacker on a network with access to a NetScaler Gateway instance (either external or internal) crafts multiple rapid authentication requests with carefully timed delays to exploit the race condition in session assignment. By triggering the appliance to assign session tokens out of synchronization, the attacker's session context is mixed with that of a legitimate user authentication occurring simultaneously, allowing the attacker to hijack the legitimate user's authenticated gateway session and access internal resources (SSL VPN tunnel, ICA applications, RDP sessions) without credentials. This is particularly dangerous in multi-user environments where continuous concurrent logins are normal, making the attack difficult to distinguish from legitimate activity.