CVE-2026-3055: Citrix NetScaler SAML IdP memory over-read, actively exploited
The short version: CVE-2026-3055 is an out-of-bounds memory-read flaw in NetScaler ADC and Gateway, reachable by an unauthenticated attacker when the appliance is configured as a SAML Identity Provider (IdP) — a common single-sign-on configuration. It leaks memory the way the CitrixBleed family does, it's in CISA's KEV catalog, and it's being exploited in the wild. Patch and confirm. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated memory disclosure on an internet-facing SSO gateway, actively exploited |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (CNA, v4.0) | 9.3 — Critical · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| EPSS | ~84.0% · 99.7th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-04-02 |
| Known exploited? | Yes — added to KEV on evidence of active exploitation; public technical analysis exists |
| Vulnerability type | CWE-125 out-of-bounds read → unauthenticated sensitive memory disclosure |
| Requires authenticated session? | No — pre-authentication (device must be configured as a SAML IdP) |
| Affected | NetScaler ADC & Gateway configured as a SAML IdP: 14.1 < 14.1-60.58 and 13.1 < 13.1-62.23, plus 13.1-FIPS/NDcPP < 13.1-37.262 (confirm exact builds against CTX696300) |
| Fixed in | 14.1-60.58 · 13.1-62.23 · 13.1-37.262 (FIPS/NDcPP) and later |
What you need to know
NetScaler ADC/Gateway is Citrix's edge access appliance. CVE-2026-3055 is an out-of-bounds read caused by insufficient input validation in the SAML processing logic. It's reachable by an unauthenticated attacker when the appliance is configured as a SAML Identity Provider — the setup organizations use to broker single sign-on. Default configurations without SAML IdP are not affected.
Why it's serious, and worth checking today:
- The precondition is common. SAML IdP is a mainstream SSO configuration, so "only if configured as a SAML IdP" is not a narrow carve-out for many enterprises.
- It's the CitrixBleed pattern again. A memory over-read on an internet-facing NetScaler leaks fragments of what the device holds — the same class of flaw that has repeatedly led to session-replay and initial access on these appliances.
- It's already operational. CISA added it to KEV on evidence of active exploitation, and public technical analysis is available.
Note: our older internal metadata for this item predated the advisory and listed it as not-yet-scored / not-in-KEV. Verified against NVD and CISA, it is a Critical-band, KEV-listed, actively exploited flaw — treat it accordingly.
How serious we see it
High — NVD scores it 9.8 and the CNA 9.3, both Critical; it's unauthenticated, KEV-listed, and being exploited. An unauthenticated memory leak on an internet-facing SSO gateway is exactly the profile that turned earlier NetScaler bugs into initial-access events. The bounded, reassuring part: it only applies to appliances configured as a SAML IdP, the fixed builds are published, and you can determine the SAML IdP configuration quickly by inspecting your NetScaler config. As with any actively exploited edge bug, patch and verify you weren't already touched.
Recommendations
Straight from Citrix's bulletin (CTX696300) and CISA:
- Patch now. Upgrade to 14.1-60.58 / 13.1-62.23 (or the matching FIPS/NDcPP build 13.1-37.262) or later — confirm the exact target build against the advisory.
- Confirm the SAML IdP configuration. Check your NetScaler config for a SAML IdP profile to determine whether you're exposed.
- Hunt. Follow Citrix's and CISA's guidance to review logs for exploitation, and treat session material handled during the exposure window as potentially leaked.
- If you find evidence of compromise, respond. Rotate credentials, keys, and certificates; terminate and reissue sessions as advised.
- Harden exposure. Keep management interfaces private and limit internet reachability to what the gateway needs.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing NetScaler interfaces, fingerprints the build, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV.
NetScaler keeps producing edge-appliance bugs; the value of a continuous, outside-in view is that each new one lands against an asset map you already have, so you go straight to patch-and-verify.