Race Condition in NetScaler Gateway Causes User Session Mixup

Publication date: 2026-03-23

Last updated on: 2026-05-10

Assigner: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Description

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-23

Last Modified

2026-05-10

Generated

2026-07-06

AI Q&A

2026-03-31

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4368

EUVD

EUVD-2026-14547

Affected Vendors & Products

Vendor	Product	Version / Range
citrix	netscaler_adc	*
citrix	netscaler_gateway	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition found in Citrix NetScaler ADC and NetScaler Gateway appliances when they are configured as Gateway (such as SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The race condition can lead to a user session mixup.

Impact Analysis

The vulnerability can cause user session mixups, which means that sessions of different users might be incorrectly handled or interchanged. This can lead to unauthorized access to another user's session or data, potentially compromising confidentiality and security.

Hi! I’m here to help you understand CVE-2026-4368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70