CVE-2026-3055

Insufficient input validation leading to memory overread

Exploited in the wild. In CISA KEV since 2026‑03‑30. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile99th91% chance in 30 days CISA KEVListedsince 2026-03-30, due 2026-04-02
No public exploit known Fix5 products5 fixed builds listed below

Check it yourself

Nuclei · 1 templateOpenVAS · 2 checks

e.g. Citrix NetScaler SAML IDP - Memory Overread · OID 1.3.6.1.4.1.25623.1.0.156590

Run the check

Published 2026-03-23Updated 2026-03-31Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

NetScaler ADCAffected: ≥ 14.1, < 66.59Upgrade to: 66.59Affected: ≥ 13.1, < 62.23Upgrade to: 62.23Affected: ≥ 13.1 FIPS and NDcPP, < 37.262Upgrade to: 37.262Stated by: CVE record
NetScaler GatewayAffected: ≥ 14.1, < 66.59Upgrade to: 66.59Affected: ≥ 13.1, < 62.23Upgrade to: 62.23Stated by: CVE record
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-62.23Upgrade to: 13.1-62.23Stated by: NVD
Citrix Netscaler Application Delivery ControllerAffected: ≥ 13.1, < 13.1-37.262Upgrade to: 13.1-37.262Stated by: NVD
Citrix Systems Inc. Citrix ADCAffected: от 14.1 до 14.1-66.59Upgrade to: not statedStated by: BDU

Versions as the sources state them. 2 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Citrix ADC / NetScaler Gateway is configured as a SAML IDP (Service Provider / Identity Provider role) and whether your gateway is internet-reachable.
If it is a SAML IDP, upgrade to the fixed versions: ADC fixed in 66.59 or 62.23 or 37.262; Gateway fixed in 66.59 or 62.23; netscaler application delivery controller fixed in 13.1-37.262; netscaler gateway fixed in 13.1-62.23.
If you cannot upgrade right away, follow Citrix vendor mitigations from their guidance for CVE-2026-3055 and implement them immediately.
Confirm after changes that the SAML IDP functions still work and monitor availability and error logs for unusual spikes.

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

3 publishers

Exploitation reported in the wild
as reported · Sep 4, 2026·BleepingComputer summary
Added to CISA KEV catalog
Mar 30, 2026·CISA KEV
Technical analysis published
as reported · Mar 28, 2026·watchTowr Labs

Sourced from public security reporting — each date is when it was published, not when it happened. 13 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

In plain language

Written by AI from the record

CVE-2026-3055 is a serious flaw in Citrix ADC / NetScaler Gateway when they’re set up as a SAML IDP: an attacker can trigger a memory “read past the end” to expose data or crash the system, without needing a login. If you run this SAML IDP setup, you should act immediately.

In Citrix ADC / NetScaler Gateway, when configured as a SAML IDP, insufficient input validation can lead to a network-triggered memory overread (CWE-125), allowing potential sensitive data exposure and/or denial of service without authentication.

If you're affected

Sensitive data exposure
System crash / service outage
Disrupted logins and authentication
Increased ransomware risk

What is it

This vulnerability lets a remote attacker trick your SAML login component into reading memory it shouldn’t. That can either reveal sensitive information (like parts of sessions or internal data) or crash the system so users can’t sign in. It matters most if your Citrix ADC / NetScaler Gateway is actively used as your organization’s SAML IDP (the system that other apps trust for logins).

Who is affected

This matters if you use Citrix ADC / NetScaler Gateway for authentication and have configured it as a SAML IDP. The flaw is reachable over the network and does not require an attacker to have a login. It’s a risk when the vulnerable SAML IDP configuration is reachable from the attacker’s network path (for example, via internet-facing access).

How urgent is it

This is a RED issue because CISA added it to the Known Exploited Vulnerabilities list, meaning it’s being treated as actively risky in real environments. The practical impact includes data exposure and service crashes, and the affected setup is often internet-facing due to authentication traffic. The CISA remediation due date is 2026-04-02.

What to do — in detail

Identify exposure
- Confirm whether your Citrix ADC / NetScaler Gateway is configured as a SAML IDP (not just a relay/proxy). The finding notes the risk specifically when the system is configured as a SAML IDP.
- Determine whether the SAML IDP endpoints are reachable from untrusted networks (internet or broader than internal users).
Check current version and match to fixed releases
- For Citrix ADC: upgrade to 66.59 or 62.23 or 37.262.
- For Citrix ADC Gateway / NetScaler Gateway: upgrade to 66.59 or 62.23.
- For netscaler application delivery controller: fixed in 13.1-37.262.
- For netscaler gateway: fixed in 13.1-62.23.
Upgrade plan
- Schedule an upgrade as an emergency change because availability is part of the risk (crashes/overreads).
- After upgrading, verify SAML IDP functionality (logins, certificate/trust settings, metadata, and any SAML claims) and ensure the service health is normal.
If you cannot upgrade immediately
- Apply the mitigations per Citrix vendor instructions for CVE-2026-3055.
- If Citrix provides an option to discontinue or disable the vulnerable SAML IDP behavior while mitigation is unavailable, that is explicitly called out in the KEV guidance.
What to monitor during/after remediation
- Look for unusual error rates, restarts, or crashes around SAML processing.
- Monitor authentication logs for abnormal patterns in SAML requests (spikes, malformed requests, or repeated failures).
- Validate that application sign-ins are stable after the change.
Timing
- CISA KEV remediation due date: 2026-04-02.

Technical context

Severity is CRITICAL (CVSS 9.8) and the weakness is CWE-125 (insufficient input validation). The mechanism is a network-triggered memory overread in Citrix ADC / NetScaler Gateway when configured as a SAML IDP, enabling potential sensitive data exposure and/or denial of service (crash). CISA KEV lists this issue and sets a remediation due date of 2026-04-02, which indicates active real-world concern and requires prioritization. No public exploit code is listed in the findings, but KEV status overrides reliance on proof-of-concept availability. Patch guidance exists via multiple fixed versions across ADC and Gateway branches as provided in the findings. EPSS is high (prediction only) and press attention is rising; however, the decisive factor for urgency here is CISA KEV inclusion.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-03-30.

US federal agencies must remediate by 2026-04-02.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

91% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

18 events over 216 days, from the signal feeds we watch.

2026-10-25EPSS band change0 → criticalepss band change
2026-10-05EPSS band changehigh → low
2026-09-30EPSS band changehigh → low
2026-09-24EPSS band changehigh → 0epss band change
2026-06-25OpenVAS check added
2026-05-04EPSS band changemoderate → high

Affected products

Citrix Systems Inc.commercial · USaka citrix adc, citrix gateway, netscaler gateway
- Citrix ADCSaaS ServiceSaaSCloud & SaaS / api-gateway
- NetScaler GatewayNetwork DeviceOn-premNetworking Infrastructure
- NetScaler ADC FIPSNetwork DeviceOn-premNetworking Infrastructure / firewall
- NetScaler ADC NDcPPNetwork DeviceOn-premNetworking Infrastructure / firewall
NetScalercommercial · USaka citrix, xenserver, application delivery controller firmware, netscaler gateway firmware
- ADCOn-premNetworking Infrastructure / load-balancer-proxy
- GatewayOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-125No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

CollectionT1005Data from Local Systemmedium confidence

Sources

References in the record

And 1 more reference. See all after sign-in

In the news

All news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for ADC, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account