CVE-2026-4368 describes a race condition vulnerability in Citrix NetScaler ADC and Gateway appliances when configured as Gateway or AAA virtual servers. The race condition can cause user session mixups, where session data may be incorrectly assigned or shared between different users. This affects version 14.1.66.54 of the product. The CVSS 4.0 score is 7.7 (high severity), with network attack vector, low attack complexity, partial privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been reported.

The vulnerability can lead to user session mixups, which may result in unauthorized access to session data belonging to other users. This can compromise confidentiality and integrity of user sessions and potentially disrupt availability. The impact is rated high based on the CVSS score and the nature of session management flaws.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully monitor official Citrix advisories and consider applying any recommended temporary mitigations or configuration changes provided by the vendor. No specific mitigation steps are currently documented.