Summary

CVE-2026-3055 is a critical out-of-bounds memory read vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers. The flaw, disclosed on March 23, 2026, carries a CVSS v4.0 score of 9.3 and enables unauthenticated remote actors to read appliance memory and potentially leak sensitive information. Active reconnaissance targeting this vulnerability has been reported by multiple threat intelligence vendors, increasing the urgency for rapid mitigation.

Affected Products and Patched Versions

The vulnerability impacts customer-managed NetScaler appliances when configured as SAML IDP. Citrix-managed cloud instances were automatically updated and are not affected. Specific vulnerable and patched versions include:

NetScaler ADC/Gateway 14.1: vulnerable before 14.1-66.59; patched in 14.1-66.59 and later
NetScaler ADC/Gateway 13.1: vulnerable before 13.1-62.23; patched in 13.1-62.23 and later
NetScaler ADC 13.1-FIPS/NDcPP: vulnerable before 13.1-37.262; patched in 13.1-37.262 and later

Attack Requirements and Impact

The issue requires that the appliance be configured as a SAML Identity Provider. Appliances not configured for SAML IDP are not affected. The vulnerability is exploitable remotely without authentication over the network, and the attack complexity is low. Successful exploitation can expose high-value secrets from memory, including session tokens, active cookies, administrative credentials, SSL private keys, and other sensitive in-memory data.

Current Threat Landscape

Active reconnaissance activity against this vulnerability has been observed. No confirmed in-the-wild exploitation has been publicly reported at this time, and no public proof-of-concept exploit is known. However, the combination of unauthenticated access, low complexity, and Citrix appliances commonly positioned on enterprise perimeters means exploitation is assessed as likely. Historical incidents involving Citrix memory leaks such as CitrixBleed (CVE-2023-4966) and CitrixBleed2 (CVE-2025-5777) demonstrate rapid weaponization following disclosure.

Indicators of Compromise and What to Monitor

Unusual SAML authentication requests targeting NetScaler endpoints
Unexpected or malformed traffic to endpoints related to SAML IDP functions, for example requests referencing /saml/login paths
Response anomalies that may contain unexpected memory artifacts or data fragments
Spike in unauthenticated network traffic to NetScaler management or proxy ports
Honeypot detections of crafted SAML requests designed to trigger overreads

Immediate Mitigation and Detection Recommendations

Patch immediately. Apply the patched releases listed above as a priority remediation step for affected appliances.
Verify SAML IDP configuration. If SAML Identity Provider functionality is not required, disable it temporarily to remove exposure.
Deploy detection rules. Create or enable IDS/IPS signatures and logging rules focused on anomalous SAML payloads and unusual GET or POST requests to SAML endpoints.
Review logs. Search for anomalous access attempts and memory leak artifacts dating from and after the disclosure date to detect potential reconnaissance or exploitation activity.
Isolate and investigate any appliance exhibiting suspicious behavior and preserve memory and network captures for forensic analysis.

Related Vulnerabilities and Patch Guidance

Citrix released fixes for CVE-2026-3055 alongside other issues in the same update batch, including CVE-2026-4368, a race condition that can lead to session mix-up. Applying the full security update addresses both issues and reduces overall risk. Citrix-managed cloud instances have been updated automatically, but customer-managed appliances require manual intervention.

Actionable Timeline and Prioritization

Treat this vulnerability as a high-priority remediation event. Immediate steps are to identify SAML IDP-enabled appliances, schedule emergency patching, and deploy network detections. Follow-up actions should include a comprehensive review of authentication logs, credential rotation where appropriate, and an assessment of any exposed private keys or sessions.

Conclusion

CVE-2026-3055 presents a critical risk for NetScaler appliances configured as SAML Identity Providers. Rapid patching, configuration hardening, and active monitoring are essential to reduce the likelihood of successful exploitation. Given the high CVSS score, low attack complexity, and past trends of rapid exploitation of Citrix memory issues, defending environments should prioritize remediation and detection now.