CVE-2026-4368
Race Condition in NetScaler Gateway Causes User Session Mixup
Publication date: 2026-03-23
Last updated on: 2026-05-10
Assigner: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| citrix | netscaler_adc | * |
| citrix | netscaler_gateway | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition found in Citrix NetScaler ADC and NetScaler Gateway appliances when they are configured as Gateway (such as SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The race condition can lead to a user session mixup.
How can this vulnerability impact me? :
The vulnerability can cause user session mixups, which means that sessions of different users might be incorrectly handled or interchanged. This can lead to unauthorized access to another user's session or data, potentially compromising confidentiality and security.