CVE-2026-4368

CVSS 4.0: 7.7 high
EPSS: 4%p89
Published: Mar 23, 2026 · Mar 23, 2026
Modified: Jun 17, 2026

Analyze CVE-2026-4368 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

Weakness: CWE-362

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news

8 stories

CISA orders feds to patch exploited Citrix flaws by Wednesday

CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.

BleepingComputerSep 28, 06:24 UTC · Sep 28, 2026Exploit / PoCExploitedCVE-2026-88771 CVE-2026-88772 CVE-2026-3055+22 · 1 read

Citrix warns admins to patch new NetScaler RCE flaw immediately

Citrix urges immediate patches for critical NetScaler RCE CVE-2026-107406, with no known exploitation yet.

BleepingComputerOct 9, 08:27 UTC · 21d agoVulnerabilityCVE-2026-107406 CVE-2026-3055 CVE-2026-4368+36 · 3 reads

U.S. CISA adds a flaw in Citrix NetScaler to its Known Exploited Vulnerabilities catalog

Security AffairsMar 31, 09:31 UTC · Mar 31, 2026Exploit / PoCExploitedCVE-2026-3055 CVE-2023-4966 CVE-2026-43681

Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks

The Hacker NewsMar 24, 05:59 UTC · Mar 24, 2026Exploit / PoCExploitedCVE-2026-3055 CVE-2026-4368 CVE-2023-4966+31

2026-003: Multiple Vulnerabilities in Citrix NetScaler and Citrix ADC

Citrix NetScaler ADC and Gateway flaws enable memory information disclosure and user session mix-up; no active exploitation is observed yet.

CERT-EU AdvisoriesMar 23, 00:00 UTC · Mar 23, 2026VulnerabilityCVE-2026-3055 CVE-2026-43682