Critical Citrix NetScaler and Gateway Vulnerabilities Let Remote Attackers Leak Sensitive Information

Cloud Software Group published a security bulletin detailing two vulnerabilities in customer-managed Citrix NetScaler ADC and Gateway appliances: CVE-2026-3055, an out-of-bounds read (CVSS 9.3) affecting appliances configured as SAML Identity Providers, and CVE-2026-4368, a race condition that can cause user session mixups on Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) and AAA virtual servers. Administrators should check configurations for 'add authentication samlIdPProfile', 'add authentication vserver', or 'add vpn vserver' to determine exposure and immediately apply the vendor's firmware updates; Citrix-managed cloud services are reported as already remediated and no active exploitation has been observed.