netscaler saml memory overread exploited a week after patch
A NetScaler ADC and Gateway bug could leak appliance memory to unauthenticated attackers when the box acts as a SAML identity provider, and it reached CISA's exploited list seven days later.
- cve
- CVE-2026-3055
- cvss
- 9.3 (v4.0, Citrix); 9.8 (v3.1, NVD)
- affected
- NetScaler ADC and Gateway 14.1 before 14.1-60.58, 13.1 before 13.1-62.23, ADC 13.1-FIPS/NDcPP before 13.1-37.262 (SAML IdP configurations)
- fixed in
- 14.1-60.58, 14.1-66.59+, 13.1-62.23+, 13.1-FIPS/NDcPP 13.1.37.262+
- exploited
- yes — added to CISA KEV 2026-03-30
- platforms
- customer-managed NetScaler ADC / NetScaler Gateway
what happened
- Citrix published bulletin CTX696300 on 2026-03-23 for CVE-2026-3055, insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway.[1,2]
- Only appliances configured as a SAML IdP are affected; admins can check for an "add authentication samlIdPProfile" entry in the configuration.[1]
- Citrix scored it 9.3 under CVSS v4.0; NVD scored it 9.8 under CVSS v3.1.[1,2]
- Fixed builds are 14.1-60.58, 14.1-66.59 and later, 13.1-62.23 and later, and 13.1-FIPS/NDcPP 13.1.37.262 and later; only customer-managed appliances are affected, as Citrix updates its managed cloud services itself.[1]
- Citrix found the flaw internally; Rapid7 noted no known in-the-wild exploitation at publication and later reported that watchTowr Labs published a technical analysis on 2026-03-29; CISA added it to KEV on 2026-03-30 with a 2026-04-02 due date.[1,4,3]
- The same bulletin fixed CVE-2026-4368 (CVSS v4.0 7.7), a race condition causing user session mix-ups that affects only build 14.1-66.54.[1]
where sources differRapid7 lists 14.1-66.59 as the 14.1 fix (affected: before 14.1-66.59), while Citrix's same-day update to the bulletin also lists 14.1-60.58 as fixed. CVSS differs by version and scorer: Citrix 9.3 (v4.0) vs NVD 9.8 (v3.1). Citrix writes the FIPS build as both 13.1-37.262 and 13.1.37.262.
sources4
- 01NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368 (CTX696300) ↗ primaryCitrix / Cloud Software Groupaccessed 2026-10-21
- 02NVD CVE API record for CVE-2026-3055 ↗ primaryNIST NVDaccessed 2026-10-21
- 03CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 04CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds Read ↗ secondaryRapid7accessed 2026-10-21