Citrix NetScaler ADC & Gateway SAML IDP Memory Overread Vulnerability (CVE-2026-3055) Security Advisory

Affected Vendors

citrix

Affected Components

netscaler adc, netscaler gateway

Published Date

2026-03-23

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Citrix NetScaler ADC and NetScaler Gateway appliances configured to act as a SAML Identity Provider (IDP)

Impact

Unauthenticated remote attackers can trigger an out-of-bounds memory read, potentially exposing highly sensitive session tokens, credentials, or SSL private keys, and facilitating remote code execution

Mitigation

Immediately apply the official security updates provided by Citrix, or temporarily disable the SAML IDP configuration if patching cannot be performed immediately

Affected Products & Version Scope

Citrix NetScaler ADC and NetScaler Gateway (Only affected when configured as a SAML IDP)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Security Patches

Download and install the latest firmware updates from the Citrix Support Portal (CTX696300).

2. Temporary Mitigation (If patching is delayed)

If the SAML IDP service is not business-critical, disable the associated VPN virtual server via the NetScaler CLI:

bash

# Example: Disabling the SAML IDP Virtual Server
disable vpn vserver <SAML_IDP_VServer_Name>

3. WAF / IPS Signature Deployment

Configure Web Application Firewalls (WAF) to inspect and block anomalous or malformed XML payloads within the SAMLRequest parameter.

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active in-the-wild exploitation (CISA KEV), prioritize patching all NetScaler instances configured as SAML IDPs immediately.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

CVE-2026-3055 is a critical input validation vulnerability (CWE-125: Out-of-bounds Read) residing in the SAML Identity Provider (IDP) module of Citrix NetScaler ADC and Gateway.

When processing maliciously crafted SAML authentication requests, the system fails to properly validate input boundaries, allowing an unauthenticated remote attacker to read adjacent memory spaces. This memory overread can leak sensitive data residing in the process memory, such as active user session tokens, administrative credentials, and cryptographic keys.

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog with an EPSS score of 0.94, making immediate remediation a top priority.

Official Vendor Advisories & References

NVD Original English Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300

Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 · Vendor Advisory

https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Exploit, Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: