Citrix NetScaler Flaws Open Door to Memory Leaks and Session Hijacking
Two critical vulnerabilities in Citrix NetScaler appliances could allow unauthenticated attackers to siphon sensitive data from memory or hijack active user sessions. The flaws, one of which carries a near-maximum severity rating, echo the trauma of previous Citrix Bleed incidents that saw widespread exploitation across enterprise environments. While no active attacks have been confirmed, the pattern is clear: threat actors historically move fast when NetScaler weaknesses surface.
🔴 CVE-2026-3055 (CVSS 9.3)
Type: Out-of-bounds read leading to memory overread.
Impact: Unauthenticated remote attackers can leak potentially sensitive information from the appliance's memory.
Condition: The appliance must be configured as a SAML Identity Provider (SAML IDP). Default configurations are not affected.
🔍️ Check: Run this command to inspect your configuration: "add authentication samlIdPProfile .*"
🔴 CVE-2026-4368 (CVSS 7.7)
Type: Race condition leading to user session mixup.
Impact: Could allow attackers to mix up user sessions, potentially gaining unauthorized access.
Condition: The appliance must be configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an Authentication, Authorization, and Accounting (AAA) server.
🔍️ Check: Look for:
AAA virtual server: add authentication vserver .
Gateway: add vpn vserver .
🩸 The CVE-2026-3055 flaw is particularly concerning because it sounds dangerously familiar. Citrix Bleed (CVE-2023-4966) and Citrix Bleed 2 (CVE-2025-5777) were memory leak vulnerabilities that attackers weaponized extensively for initial access. History shows that once proof-of-concept emerges, exploitation follows quickly.
NetScaler appliances are prime targets because they sit at the network edge, handling authentication, VPN access, and application delivery. Compromising one often means bypassing perimeter defenses entirely.
Affected Versions
NetScaler ADC and Gateway 14.1 before 14.1-66.59
NetScaler ADC and Gateway 13.1 before 13.1-62.23
NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.262
🛡️ Immediate Actions
→ Identify all NetScaler ADC and Gateway instances in your environment.
→ Check version numbers against the affected list.
→ If running a vulnerable version, patch immediately to the fixed releases.
→ Verify configuration: Not all deployments are vulnerable, but assume risk until confirmed otherwise.
→ Monitor for unusual memory access patterns or session anomalies.
Citrix NetScaler flaws have a history of becoming active attack vectors fast. These two new vulnerabilities, especially the memory leak, fit the same profile. Default configurations may be safe, but many enterprises customize deployments with SAML IDP or gateway functions. If that describes your environment, treat this as a high-priority patch. The window before exploitation is likely narrow.