Citrix Products Vulnerabilities

CERT-FR Security Advisories

Published March 23rd, 2026

Detected March 23rd, 2026

Summary

CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Citrix NetScaler ADC and Gateway products. These vulnerabilities could lead to data confidentiality breaches and security policy bypasses. Affected versions require immediate patching.

View original document View source feed page

What changed

CERT-FR, the French national cybersecurity agency, has issued an advisory (CERTFR-2026-AVI-0337) detailing multiple critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products. The vulnerabilities, identified by CVE-2026-3055 and CVE-2026-4368, can allow attackers to compromise data confidentiality and bypass security policies. Specific affected versions include NetScaler ADC 13.1-FIPS, 13.1-NDcPP, 13.1.x, and 14.0.x, as well as NetScaler Gateway 13.1.x and 14.0.x, prior to the application of specific patch versions.

Organizations utilizing the affected Citrix products must immediately consult the vendor's security bulletin (CTX696300) and apply the necessary patches to mitigate the risks of data breaches and security policy circumvention. Failure to do so could result in significant security incidents, including unauthorized access to sensitive information and disruption of network security controls. This advisory highlights the critical need for timely vulnerability management and patching for network infrastructure components.

What to do next

Consult Citrix security bulletin CTX696300
Apply vendor-provided patches to affected NetScaler ADC and Gateway versions
Verify successful patch deployment and system integrity

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 23 mars 2026 N° CERTFR-2026-AVI-0337 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Citrix

Gestion du document

Risques

Atteinte à la confidentialité des données
Contournement de la politique de sécurité

Systèmes affectés

NetScaler ADC 13.1-FIPS et 13.1-NDcPP versions antérieures à 13.1.37.262
NetScaler ADC versions 13.1.x antérieures à 13.1-62.23
NetScaler ADC versions 14.0.x antérieures à 14.1-66.59
NetScaler Gateway  versions 13.1.x antérieures à 13.1-62.23
NetScaler Gateway  versions 14.0.x antérieures à 14.1-66.59

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Citrix. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.