CVE-2026-3055: Citrix NetScaler ADC and Gateway SAML IDP memory overread

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.3, CISA KEV listing with a short due date, and an exploit-tagged reference indicate active, unauthenticated remote exploitation.

What it is

NetScaler ADC and NetScaler Gateway, when configured as a SAML identity provider, fail to validate input sufficiently, causing an out-of-bounds memory read. The flaw is remotely reachable without authentication and is listed in CISA KEV, so it warrants urgent attention.

Impact

An unauthenticated remote attacker can read memory beyond intended bounds, potentially exposing sensitive data such as credentials or session material. The CVSS 4.0 vector also indicates high integrity and availability impact, though the description only confirms the overread.

Attack surface

Reached over the network via the SAML IDP interface; the CVSS vector shows no privileges or user interaction required. Only deployments configured as a SAML IDP are exposed.

Exploitation

CISA added it to KEV on 2026-03-30 with a 2026-04-02 due date, and a third-party advisory carries an Exploit tag, indicating active exploitation. EPSS is 0.87166 (99.74th percentile), consistent with high likelihood.

What to do

• Apply the Citrix vendor advisory CTX696300 fix immediately; treat as emergency patching.
• If patching is not possible, follow CISA BOD 22-01 guidance or discontinue use of the affected SAML IDP configuration.
• Restrict network access to NetScaler SAML IDP endpoints to trusted sources where feasible.
• Review SAML IDP configurations and disable the role if not required.
• Monitor Citrix and CISA advisories for updated mitigation instructions.

Detection

• Inspect NetScaler and gateway logs for anomalous SAML IDP requests or malformed SAML assertions.
• Hunt for unexpected outbound connections or data exfiltration from NetScaler appliances.
• Correlate NetScaler access logs with known exploitation indicators from the WatchTowr advisory.
• Alert on unusual memory or crash events on NetScaler instances acting as SAML IDP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.