Cloud Software Patches NetScaler Vulnerabilities

Cloud Software Group, the parent company of Citrix, has released security updates to address two vulnerabilities in its NetScaler application delivery controller and NetScaler Gateway remote access solutions, with the more severe flaw posing risks of sensitive data leakage for certain configurations.

The critical vulnerability, tracked as CVE-2026-3055 and assigned a CVSS score of 9.3, stems from insufficient input validation that can result in a memory overread. It affects NetScaler ADC and NetScaler Gateway appliances only when configured as a SAML identity provider, a setup commonly used for single sign-on in organizations. Unauthenticated remote attackers could potentially exploit this to extract sensitive information, such as session tokens, from the device's memory. Default configurations remain unaffected, and the issue impacts customer-managed instances but not those hosted in Citrix-managed cloud services.

The second vulnerability, CVE-2026-4368 with a CVSS score of 7.7, involves a race condition that could lead to session mix-ups, allowing low-privilege users to access another user's session. This flaw applies to appliances set up as SSL VPN gateways, ICA proxies,...