Article
Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead)
CVSS scores show worst-case severity, not attacker behavior. See how EPSS, the CISA KEV catalog and SSVC help you decide which flaws to fix…
Read more
Exploited vulnerability
NetScaler SAML memory overread (CVE-2026-3055)
CVE-2026-3055
CVE-2026-3055 is a flaw in NetScaler ADC and NetScaler Gateway where weak input checking lets the device read and return memory it should not.
- On CISA KEV
- CVE ID
- CVE-2026-3055
- CISA KEV
- Listed
- Affected product
- NetScaler ADC and NetScaler Gateway
- Exploited
- Yes
- Published
- March 2026
In short
CVE-2026-3055 is a flaw in NetScaler ADC and NetScaler Gateway where weak input checking lets the device read and return memory it should not. It only matters when the appliance acts as a SAML identity provider (IDP), the part that signs users in for other apps. CISA lists it as exploited.
- CVECVE-2026-3055
- ProductCloud Software Group (NetScaler, formerly Citrix) NetScaler ADC and NetScaler Gateway
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade to a fixed build · Find out if you are exposed
What it allows
A remote attacker with no account can make an appliance set up as a SAML IDP return memory it should keep private. The vendor rates it 9.3 (Critical) on CVSS v4.0, with high impact on confidentiality, integrity and availability. NVD shows the vendor's score and lists no separate NVD score.
Who is affected
Per the vendor, customer-managed NetScaler ADC and Gateway 14.1 before 14.1-60.58, 13.1 before 13.1-62.23, and NetScaler ADC FIPS and NDcPP before 13.1-37.262 are affected, when configured as a SAML IDP. The vendor says you can check by searching the configuration for 'add authentication samlIdPProfile'. Citrix-managed cloud services are updated by the vendor.
The vendor published its bulletin on 23 March 2026, together with a second flaw, CVE-2026-4368. It says it found CVE-2026-3055 internally in its own security reviews. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog on 30 March 2026, saying it was based on evidence of active exploitation, with a due date of 2 April 2026. The KEV entry lists ransomware use as Unknown.
The sources opened here do not say when exploitation began and name no group or malware. Attribution is not public. The vendor bulletin itself does not state that the flaw is exploited. Another NetScaler incident from September 2026 concerns different CVE numbers and is not linked here.
What to do
-
Upgrade to a fixed build
The vendor names 14.1-60.58 (and 14.1-66.59 or later), 13.1-62.23 or later 13.1 releases, and 13.1-FIPS and 13.1-NDcPP 13.1.37.262 or later.
-
Find out if you are exposed
Search the NetScaler configuration for 'add authentication samlIdPProfile'. If it is present, the appliance is configured as a SAML IDP and is in scope.
-
Check the second flaw
The same bulletin covers CVE-2026-4368, which only affects build 14.1-66.54 when set up as a Gateway or AAA virtual server.
-
Detect and hunt
The vendor bulletin gives no indicators. Review SAML IDP request logs for unusual or malformed requests before patching, and treat sessions and secrets that passed through an exposed SAML IDP as possibly exposed.
Questions
What is CVE-2026-3055?
CVE-2026-3055 is a memory overread in NetScaler ADC and NetScaler Gateway caused by insufficient input validation. A remote attacker with no account can make an appliance set up as a SAML identity provider return memory it should keep private. The vendor rates it 9.3 on CVSS v4.0.
Which NetScaler versions are affected by CVE-2026-3055?
Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-60.58, 13.1 before 13.1-62.23, and ADC FIPS and NDcPP before 13.1-37.262, when configured as a SAML IDP. Citrix-managed cloud services are updated by the vendor.
How do I know if my NetScaler is exposed to CVE-2026-3055?
Search the NetScaler configuration for 'add authentication samlIdPProfile'. If it is present, the appliance is configured as a SAML identity provider and is in scope, so upgrade to a fixed build.
Is CVE-2026-3055 being exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 30 March 2026, based on evidence of active exploitation. The KEV entry lists ransomware use as Unknown, and no group or malware is publicly named.
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.