Critical NetScaler ADC/Gateway Vulnerability Alert

CSA Alerts & Advisories (Singapore)

Published March 26th, 2026

Detected March 26th, 2026

Summary

The Cyber Security Agency of Singapore (CSA) has issued an alert regarding critical vulnerabilities in NetScaler ADC and NetScaler Gateway. Users are strongly advised to update their systems immediately to mitigate risks of sensitive information disclosure and session compromise.

View original document View source feed page

What changed

The Cyber Security Agency of Singapore (CSA) has issued an urgent alert concerning two critical vulnerabilities (CVE-2026-3055 and CVE-2026-4368) affecting NetScaler ADC and NetScaler Gateway products. These vulnerabilities could allow remote attackers to access sensitive in-memory information, such as session tokens and user credentials, or compromise user sessions routed through the appliance. Affected versions include those prior to NetScaler ADC and Gateway 14.1-66.59, NetScaler ADC and Gateway 13.1-62.23, and NetScaler ADC 13.1-FIPS and NDcPP 13.1-37.262.

Users and administrators of affected NetScaler products must update to the latest available versions immediately to prevent exploitation. Failure to patch these vulnerabilities could lead to significant data breaches and system compromises, impacting the confidentiality and integrity of network traffic and user sessions. This advisory emphasizes the critical need for prompt security patching in network infrastructure devices.

What to do next

Update NetScaler ADC and NetScaler Gateway to the latest secure versions immediately.

Source document (simplified)

Alerts

Critical Vulnerability in NetScaler ADC and NetScaler Gateway

26 March 2026

Citrix has released security updates to address two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Users and administrators of affected products are advised to update to the latest versions immediately.

Background

Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway. The vulnerabilities include an out-of-bounds read and a session-related flaw that could allow attackers to access sensitive information or compromise user sessions.

Impact

Successful exploitation of these vulnerabilities could allow:

CVE-2026-3055: A remote unauthenticated attacker to gain access to sensitive in‑memory information such as session tokens or user credentials.
CVE-2026-4368: An attacker to compromise the integrity and confidentiality of user sessions routed through the appliance.
Affected Products

The following product versions are affected by the vulnerabilities.

Versions prior to NetScaler ADC and NetScaler Gateway 14.1-66.59
Versions prior to NetScaler ADC and NetScaler Gateway 13.1-62.23
Versions prior to NetScaler ADC 13.1-FIPS and NDcPP 13.1-37.262
Recommendations

Users and administrators of affected product versions are advised to update to the latest versions immediately.

References

https://thehackernews.com/2026/03/citrix-urges-patching-critical.html

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

https://nvd.nist.gov/vuln/detail/CVE-2026-3055

https://nvd.nist.gov/vuln/detail/CVE-2026-4368