CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability
Description
CVE-2026-3055 is an out-of-bounds read vulnerability (CWE-125) in Citrix NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS/NDcPP when configured as a SAML Identity Provider. The vulnerability allows an attacker to trigger a memory overread condition by exploiting insufficient input validation in the SAML IDP processing logic. The vulnerability has not yet received a CVSS score from NVD (status: Awaiting Analysis). The EPSS score of 0.026% (7.1st percentile) currently indicates a low exploitation probability relative to other CVEs, though this may increase as analysis progresses. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog on March 30, 2026, with an unusually tight remediation deadline of April 2, 2026, reflecting the urgency of patching. The KEV entry does not associate this vulnerability with known ransomware campaigns. Organizations running NetScaler in SAML IDP configuration should apply the Citrix advisory CTX696300 immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 13.1, < 13.1-37.262; >= 13.1, < 13.1-62.23; >= 14.1, < 14.1-60.58 |
| citrix | netscaler gateway | >= 13.1, < 13.1-62.23; >= 14.1, < 14.1-60.58 |
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300(Vendor Advisory)
- https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
Out-of-bounds Read is a vulnerability class where software reads data past the end or before the beginning of an intended buffer. This weakness occurs when the application fails to properly validate input lengths or buffer boundaries before performing read operations, allowing an attacker to access memory contents beyond the allocated buffer. The consequences range from information disclosure (reading sensitive data from adjacent memory regions) to denial of service (triggering application crashes through access violations).
In CVE-2026-3055, the NetScaler ADC and Gateway products contain insufficient input validation in the SAML Identity Provider processing path. When the appliance is configured as a SAML IDP, specially crafted SAML requests can cause the parsing logic to read beyond the bounds of an allocated buffer, resulting in a memory overread. This can potentially expose sensitive information stored in adjacent memory regions, such as session tokens, cryptographic material, or other authentication data processed by the SAML IDP. The vulnerability is particularly concerning in the context of a SAML IDP because the affected component handles authentication assertions and security tokens for federated identity systems. Learn more about Out-of-bounds Read (CWE-125)
Impact Analysis
CVE-2026-3055 has not yet received a CVSS score from NVD (Awaiting Analysis). However, based on the vulnerability characteristics and its addition to the KEV catalog, the following CIA triad analysis applies:
Confidentiality (Likely High): The out-of-bounds read vulnerability in the SAML IDP component can expose sensitive memory contents. Since the affected code path processes SAML authentication assertions, adjacent memory may contain session tokens, user credentials, cryptographic keys, or other authentication-related data. Memory overread vulnerabilities in authentication components have historically led to significant data exposure (similar to Heartbleed-class issues).
Integrity (Likely None to Low): Out-of-bounds read vulnerabilities typically do not directly allow modification of data. The attacker can read beyond buffer boundaries but cannot write to memory through this specific vulnerability. However, disclosed information (such as session tokens or keys) could be leveraged in secondary attacks to compromise integrity.
Availability (Likely Low to Medium): Depending on the implementation, the memory overread could trigger access violations or segmentation faults that crash the SAML IDP processing thread or the entire NetScaler service. This would disrupt authentication for all federated applications relying on the NetScaler as their SAML IDP.
Scope: The impact is contained within the NetScaler appliance, but the downstream effect on federated authentication systems could be significant. The EPSS score of 0.026% (7.1st percentile) is currently low, but the KEV listing with a 3-day remediation deadline signals confirmed active exploitation.
Exploit Maturity
Active Exploitation: CVE-2026-3055 is confirmed as actively exploited. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 30, 2026, with a federal remediation deadline of April 2, 2026. The extremely short 3-day remediation window is highly unusual and indicates that CISA has high confidence in active, ongoing exploitation.
Ransomware Association: The CISA KEV catalog does not associate CVE-2026-3055 with known ransomware campaigns. However, NetScaler appliances are high-value targets for initial access brokers, and memory disclosure vulnerabilities in authentication components can facilitate credential theft that precedes ransomware deployment.
Public Exploits: Citrix has published advisory CTX696300 addressing this vulnerability. Given the active exploitation status, proof-of-concept or weaponized exploits are likely circulating in threat actor communities, even if not yet publicly disclosed.
EPSS Context: The EPSS score of 0.026% (7.1st percentile) is currently low, which may reflect the recency of the CVE and the lack of a CVSS score. EPSS scores for newly disclosed vulnerabilities often increase as more exploitation data is collected. The KEV listing should be weighted more heavily than the current EPSS score when prioritizing remediation.
Historical Context: Citrix NetScaler has been a frequent target for advanced threat actors. Previous NetScaler vulnerabilities such as CVE-2023-4966 (Citrix Bleed) and CVE-2019-19781 were extensively exploited for initial access into enterprise networks. Organizations should treat this vulnerability with the same urgency.
Remediation
-
Apply the Citrix security update immediately. Review and follow the remediation guidance in Citrix advisory CTX696300. Install the patched firmware version for NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS/NDcPP as applicable to your deployment.
-
Assess SAML IDP exposure and restrict access. If the NetScaler is configured as a SAML IDP, evaluate whether the SAML endpoints need to be exposed to the public internet. Where possible, restrict access to SAML IDP endpoints to known service provider IP ranges using NetScaler ACLs or firewall rules.
-
Rotate SAML signing certificates and session keys. Because the memory overread could have exposed cryptographic material used in SAML assertion signing, rotate all SAML signing certificates, encryption keys, and shared secrets after applying the patch. Notify federated service providers of the certificate rotation.
-
Review authentication logs for anomalous SAML requests. Examine NetScaler logs and SIEM data for unusual SAML authentication patterns, malformed SAML requests, or unexpected authentication assertions that could indicate prior exploitation. Focus on the period between vulnerability disclosure and patch application.
-
Implement WAF rules for SAML request validation. Deploy additional input validation at the web application firewall level to filter oversized or malformed SAML requests before they reach the NetScaler SAML IDP processing engine. This provides defense-in-depth against potential bypass of the vendor patch.
Technical Details
CVE-2026-3055 is an out-of-bounds read vulnerability in Citrix NetScaler ADC and NetScaler Gateway when the appliance is configured to operate as a SAML Identity Provider (IDP). The root cause is insufficient input validation in the SAML request processing logic.
When a NetScaler appliance is configured as a SAML IDP, it processes SAML authentication requests from service providers. These requests contain XML-encoded data including issuer information, authentication context, and various SAML protocol elements. The vulnerable code path fails to properly validate the length or boundaries of certain input fields within the SAML request before performing memory read operations.
An attacker can craft a malicious SAML authentication request that causes the parser to read beyond the allocated buffer, accessing adjacent memory regions. This memory overread can disclose:
- Session state data from other active SAML sessions
- Cryptographic material including SAML signing keys or TLS session keys
- Authentication tokens for other users currently authenticated through the IDP
- Internal configuration data stored in memory by the NetScaler management plane
The vulnerability is triggered through the SAML IDP endpoint, which must be network-accessible to service providers. The attack requires no authentication, as the malicious request is processed during the pre-authentication SAML exchange phase.
The affected products include NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS/NDcPP editions. The FIPS/NDcPP edition is particularly concerning as it is deployed in environments with elevated security requirements (government, financial services).
The vulnerability has not yet received a CVSS score. Based on the characteristics — network-accessible, no authentication required, memory disclosure in an authentication component — a CVSS 3.1 score in the HIGH to CRITICAL range would be expected once analysis is complete.
Frequently Asked Questions
What is CVE-2026-3055?
CVE-2026-3055 is an out-of-bounds read vulnerability in Citrix NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS/NDcPP. When the appliance is configured as a SAML Identity Provider, insufficient input validation allows an attacker to trigger a memory overread condition that can expose sensitive data from adjacent memory regions. CISA has confirmed active exploitation and added the vulnerability to its KEV catalog with a 3-day remediation deadline.
Am I affected by CVE-2026-3055?
You are affected if you run Citrix NetScaler ADC or NetScaler Gateway configured as a SAML Identity Provider (IDP). If your NetScaler is not configured as a SAML IDP, you are not directly exposed to this specific vulnerability. Check your NetScaler configuration for SAML IDP virtual servers and policies. Consult Citrix advisory CTX696300 for the specific affected firmware versions.
How do I fix CVE-2026-3055?
Apply the firmware update referenced in Citrix advisory CTX696300 immediately. After patching, rotate all SAML signing certificates and session keys, as the memory overread may have exposed cryptographic material. Review authentication logs for signs of prior exploitation, and restrict network access to SAML IDP endpoints where possible.
How severe is CVE-2026-3055?
While CVE-2026-3055 has not yet received a formal CVSS score from NVD, the severity indicators are significant. CISA assigned a 3-day remediation deadline (one of the shortest possible), confirming high-confidence active exploitation. The vulnerability affects a critical authentication component (SAML IDP) and can expose sensitive memory contents. Citrix NetScaler has a history of critical vulnerabilities being rapidly weaponized by advanced threat actors, including the Citrix Bleed vulnerability (CVE-2023-4966). Organizations should treat this as a critical priority regardless of the pending CVSS score.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.