CVE-2026-3055

This vulnerability lets a remote attacker trick your SAML login component into reading memory it shouldn’t. That can either reveal sensitive information (like parts of sessions or internal data) or crash the system so users can’t sign in. It matters most if your Citrix ADC / NetScaler Gateway is actively used as your organization’s SAML IDP (the system that other apps trust for logins).

This matters if you use Citrix ADC / NetScaler Gateway for authentication and have configured it as a SAML IDP. The flaw is reachable over the network and does not require an attacker to have a login. It’s a risk when the vulnerable SAML IDP configuration is reachable from the attacker’s network path (for example, via internet-facing access).

This is a RED issue because CISA added it to the Known Exploited Vulnerabilities list, meaning it’s being treated as actively risky in real environments. The practical impact includes data exposure and service crashes, and the affected setup is often internet-facing due to authentication traffic. The CISA remediation due date is 2026-04-02.

1. Identify exposure

   • Confirm whether your Citrix ADC / NetScaler Gateway is configured as a SAML IDP (not just a relay/proxy). The finding notes the risk specifically when the system is configured as a SAML IDP.
   • Determine whether the SAML IDP endpoints are reachable from untrusted networks (internet or broader than internal users).

2. Check current version and match to fixed releases

   • For Citrix ADC: upgrade to 66.59 or 62.23 or 37.262.
   • For Citrix ADC Gateway / NetScaler Gateway: upgrade to 66.59 or 62.23.
   • For netscaler application delivery controller: fixed in 13.1-37.262.
   • For netscaler gateway: fixed in 13.1-62.23.

3. Upgrade plan

   • Schedule an upgrade as an emergency change because availability is part of the risk (crashes/overreads).
   • After upgrading, verify SAML IDP functionality (logins, certificate/trust settings, metadata, and any SAML claims) and ensure the service health is normal.

4. If you cannot upgrade immediately

   • Apply the mitigations per Citrix vendor instructions for CVE-2026-3055.
   • If Citrix provides an option to discontinue or disable the vulnerable SAML IDP behavior while mitigation is unavailable, that is explicitly called out in the KEV guidance.

5. What to monitor during/after remediation

   • Look for unusual error rates, restarts, or crashes around SAML processing.
   • Monitor authentication logs for abnormal patterns in SAML requests (spikes, malformed requests, or repeated failures).
   • Validate that application sign-ins are stable after the change.

6. Timing

   • CISA KEV remediation due date: 2026-04-02.

Severity is CRITICAL (CVSS 9.8) and the weakness is CWE-125 (insufficient input validation). The mechanism is a network-triggered memory overread in Citrix ADC / NetScaler Gateway when configured as a SAML IDP, enabling potential sensitive data exposure and/or denial of service (crash). CISA KEV lists this issue and sets a remediation due date of 2026-04-02, which indicates active real-world concern and requires prioritization. No public exploit code is listed in the findings, but KEV status overrides reliance on proof-of-concept availability. Patch guidance exists via multiple fixed versions across ADC and Gateway branches as provided in the findings. EPSS is high (prediction only) and press attention is rising; however, the decisive factor for urgency here is CISA KEV inclusion.