Critical Citrix NetScaler Flaw CVE-2026-3055 Exploitation Imminent

Post Views: 2

NetScaler Vulnerabilities Expose User Session Tokens

Citrix has released patches for two critical vulnerabilities in its NetScaler Application Delivery Controller (ADC) and NetScaler Gateway products.

The more severe flaw, designated as CVE-2026-3055, allows attackers to potentially extract active session tokens from the memory of affected devices, compromising user sessions.

According to Anil Shetty, Senior Vice President of Engineering at Cloud Software Group:

We are not aware of any unmitigated exploits available for CVE-2026-3055 or CVE-2026-4368. However, given the potential impact of these vulnerabilities, which can be exploited through low-complexity attacks, Citrix urges customers to upgrade to the latest patched versions as soon as possible.

Vulnerability Details

The vulnerabilities, affecting NetScaler ADC and NetScaler Gateway versions 14.1 prior to 14.1-66.59 and 13.1 prior to 13.1-62.23, respectively, stem from insufficient input validation (CVE-2026-3055) and a race condition leading to user session mix-up (CVE-2026-4368).

Systems configured as a Single Sign-On (SSO) Identity Provider are vulnerable to CVE-2026-3055, while default configurations remain unaffected.

Rapid7 notes that this SSO configuration is likely common among organizations utilizing single sign-on.

CVE-2026-4368 affects appliances configured as Gateways or AAA virtual servers, but not those running as ADCs alone.

Action Required

Cloud Software Group has already upgraded Citrix-managed cloud services and Adaptive Authentication with the latest software updates. Organizations are advised to act swiftly to prevent potential exploitation, as security updates are now available, and attackers may soon reverse-engineer the patch to create an exploit.

Futhermore, the similarity between CVE-2026-3055 and the previously exploited CitrixBleed2 flaw (CVE-2025-5777) suggests that attackers may attempt to exploit CVE-2026-3055 sooner rather than later. To mitigate this risk, organizations are recommended to restrict access to affected appliances using network-level controls.

Affected versions of NetScaler ADC and NetScaler Gateway include 14.1 before 14.1-66.59 and 13.1 before 13.1-62.23, as well as NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.26.