Security readout for executives and security teams
Plain-English summary
A flaw in NetScaler ADC and NetScaler Gateway can cause one user's login session to get mixed up with another's when the device is acting as a remote-access gateway. In practice, that means an authenticated user could end up viewing or acting under someone else's identity, which is a confidentiality and integrity problem for any organization using NetScaler for VPN or remote application access.
Executive priority
High priority for any organization using NetScaler Gateway or AAA for remote access. Schedule patching within the next standard maintenance window; treat as urgent if regulated data or privileged users traverse the affected gateways. No public exploitation reported, but session mixup is a direct identity-integrity risk worth escalating to IT leadership.
Technical view
CVE-2026-4368 is a race condition (CWE-362) in NetScaler ADC and Gateway when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Concurrent session handling can cause a user session to be associated with the wrong authenticated principal. CVSS 4.0 score is 7.7 (AV:N/AC:L/AT:P/PR:L/UI:N) with high confidentiality, integrity, and availability impacts. Fixed in 14.1.66.54.
Likely exposure
Exposure is significant for enterprises that publish NetScaler Gateway for remote workforce access (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or use AAA virtual servers for authentication. Only those Gateway/AAA configurations are in scope; standalone load-balancing NetScaler deployments without these features are not described as affected by the cited vendor record.
Exploitation context
No active exploitation is cited; the CVE is not listed in CISA KEV per the source bundle. CVSS 4.0 vector indicates network-reachable attack with low complexity, low privileges, and a passive attack requirement (AT:P), suggesting the condition depends on concurrent legitimate user activity rather than a single attacker-only action. Treat as a credible session-integrity risk pending vendor updates.
Researcher notes
CWE-362 race conditions in session handling are typically timing-sensitive and tied to concurrent authentication flows; the CVSS 4.0 AT:P (attack requirement: present) supports a non-deterministic trigger. Affected scope is explicitly Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) and AAA vservers. Fixed build 14.1.66.54 is the only version listed as unaffected. Vendor KB CTX696300 is the authoritative remediation source; consult it for full version matrix beyond the single build noted in the CVE record.
Mitigation direction
- Upgrade NetScaler ADC and Gateway to build 14.1.66.54 or later as identified by Citrix.
- Review Citrix advisory CTX696300 for any configuration-specific guidance or interim workarounds.
- Inventory appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers and prioritize those first.
- Coordinate change windows with remote-access stakeholders to minimize disruption during patching.
- Confirm management plane access is restricted to trusted networks while patching is staged.
Validation and detection
- Query each NetScaler instance for its build version and verify it is at or above 14.1.66.54.
- Enumerate vservers to confirm whether Gateway or AAA roles are configured on each appliance.
- Cross-check inventory against Citrix article CTX696300 for fixed-version matrix and applicability.
- After patching, validate user session bindings and authentication flows behave correctly under load.
- Monitor authentication and session logs for anomalous user-to-session associations during the validation window.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-4368 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——NetScalerVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300CVE reference, NetScaler
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.