EUVD-2026-14547
GHSA-445m-jc4j-p5gf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup
AnalysisAI
Citrix NetScaler ADC and Gateway instances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers are vulnerable to a race condition that enables authenticated attackers to hijack other users' sessions. An attacker with valid credentials can exploit timing-dependent conditions to cause session mixup between concurrent users, potentially gaining unauthorized access to sensitive resources or impersonating other authenticated users. No patch is currently available for this high-severity vulnerability.
Technical ContextAI
The vulnerability is rooted in a classic race condition (CWE category related to concurrent access to shared resources without proper synchronization) within NetScaler's session management infrastructure. The affected products include NetScaler ADC (cpe:2.3:a:netscaler:adc:*:*:*:*:*:*:*:*) and NetScaler Gateway (cpe:2.3:a:netscaler:gateway:*:*:*:*:*:*:*:*), which are reverse proxy and secure access appliances commonly deployed as SSL VPN gateways, ICA Proxy servers, Clientless VPN (CVPN) endpoints, RDP proxies, and AAA virtual servers. When multiple concurrent user sessions are processed by the appliance, improper synchronization of session state management allows a timing-dependent condition where session identifiers or authentication contexts can be incorrectly assigned or shared between different user connections. This is particularly critical in gateway deployments where the appliance acts as a trust boundary between untrusted networks and internal resources.
RemediationAI
Consult Citrix security advisory CTX696300 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300) for patched versions and upgrade NetScaler ADC and NetScaler Gateway to the recommended fixed release immediately. As interim mitigations pending patch deployment, consider reducing concurrent user session load through connection limits, implementing network-level access controls to restrict gateway access to known-good sources only, and enabling enhanced session monitoring and logging to detect anomalous session access patterns. Citrix may recommend appliance-level configuration hardening such as disabling unused protocols (CVPN, ICA Proxy, RDP Proxy if not required) to reduce attack surface until patches can be applied.
An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos An
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CV
OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the
Remote unauthenticated exploitation of NetScaler ADC and NetScaler Gateway allows attackers to cause high availability i
Credential theft via Lua script execution in Envoy Gateway versions before 1.5.7 and 1.6.2 allows authenticated attacker
An issue was discovered in Aviatrix Controller before 5.4.1204. Rated high severity (CVSS 7.5), this vulnerability is re
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today