CVE-2026-4368

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

CVSS

No CVSS.

References

Link	Resource
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

Configurations

No configuration.

History

No history.

Information

Published : 2026-03-23 21:17

Updated : 2026-06-17 10:56

NVD link : CVE-2026-4368

Mitre link : CVE-2026-4368

CVE.ORG link : CVE-2026-4368

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-4368", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4368", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T03:56:06.911644Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5", "affectedData": [{"vendor": "NetScaler", "product": "ADC", "versions": [{"status": "affected", "version": "14.1.66.54", "versionType": "patch"}], "defaultStatus": "unaffected"}, {"vendor": "NetScaler", "product": "Gateway", "versions": [{"status": "affected", "version": "14.1.66.54"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-23T21:17:17.667", "references": [{"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300", "source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Race Condition in\u00a0NetScaler ADC and NetScaler Gateway when appliance is configured as\u00a0Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or\u00a0AAA virtual server\u00a0leading to User Session Mixup"}, {"lang": "es", "value": "Condici\u00f3n de carrera en NetScaler ADC y NetScaler Gateway cuando el dispositivo est\u00e1 configurado como Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) o servidor virtual AAA, lo que lleva a la mezcla de sesiones de usuario."}], "lastModified": "2026-06-17T10:56:29.243", "sourceIdentifier": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}

CVE-2026-4368

JSON object

Attach tags to CVE-2026-4368

Attach tags to `CVE-2026-4368`