Cloud Software Group has sent out an important security bulletin that talks about two new security holes that have been found This article explores cloud services safe. . The bugs could let attackers from afar leak private data or mix up user sessions.
These security holes only affect NetScaler ADC and Gateway systems that customers manage themselves. Cloud environments that use Citrix-managed cloud services are safe because the vendor has already made the necessary updates to the infrastructure. Cybersecurity teams must quickly update affected devices to the most recent supported firmware versions in order to protect network infrastructure. Click here to read the whole security bulletin from Cloud Software Group, or click here to get a copy of the security bulletin for yourself.
The security bulletin lists two separate vulnerabilities that affect different setups of the Net scaler appliances.
CVE-2026-3055 is the most serious of the two flaws. It is an out-of-bounds read vulnerability that happens when input validation isn't strong enough. CVE-2026-4368 is the second vulnerability.
It is a race condition flaw that causes a user session mix-up. Only appliances that are set up as a Security Assertion Markup Language (SAML) Identity Provider (IdP) are affected by the vulnerability. Administrators can quickly check if their deployment is exposed by looking for the string "add authentication samlIdPProfile . *" in their Net scaler configuration.
