Critical NetScaler ADC and Gateway Vulnerabilities Enable Remote Attacks on Affected Systems

Cloud Software Group released urgent patches for two NetScaler ADC/Gateway vulnerabilities: CVE-2026-3055, a critical (CVSS 9.3) unauthenticated out-of-bounds read affecting appliances configured as SAML IDPs, and CVE-2026-4368, a high-severity (CVSS 7.7) race condition that can cause session mixups on Gateway or AAA vservers; the advisory lists affected versions, configuration checks to verify exposure, and fixed release versions, and notes no active exploitation was observed at disclosure.