Citrix NetScaler CVE-2026-3055: SAML IdP memory leak exploited after patch

On 23 March 2026 Citrix patched two NetScaler ADC and Gateway flaws. One of them, CVE-2026-3055, is an unauthenticated memory overread on appliances set up as a SAML identity provider. Within days attackers were exploiting it, and CISA added it to its Known Exploited Vulnerabilities catalog on 30 March. If your SSO runs through a NetScaler, check this before anything else.

What happened

Citrix bulletin CTX696300 covers two bugs:

• CVE-2026-3055 (CVSS v4.0 9.3): insufficient input validation that causes an out-of-bounds memory read when NetScaler ADC or Gateway is configured as a SAML IdP. An unauthenticated remote attacker can read memory that may contain session tokens. Citrix found it internally.
• CVE-2026-4368 (CVSS v4.0 7.7): a race condition that can mix up user sessions on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. It affects build 14.1-66.54 only.

When it was disclosed, Rapid7 noted that default configurations are not affected but that SAML IdP setups are common wherever NetScaler fronts single sign-on. watchTowr later reported in-the-wild exploitation, starting around 27 March by Picus Security's timeline, that could leak admin session IDs and lead to full appliance takeover. CISA set a federal patch deadline of 2 April 2026. Shadowserver counted nearly 30,000 NetScaler ADC and more than 2,300 Gateway instances exposed online, but could not say how many were vulnerable. Security researchers have nicknamed the bug "CitrixBleed 3" because it resembles CitrixBleed (CVE-2023-4966) and CitrixBleed 2.

Who is affected

CVE-2026-3055 affects NetScaler ADC and NetScaler Gateway configured as a SAML IdP, on:

• 14.1 before 14.1-66.59
• 13.1 before 13.1-62.23
• 13.1-FIPS and 13.1-NDcPP before 13.1-37.262

CVE-2026-4368 affects only 14.1-66.54 in Gateway or AAA configurations. Cloud-managed Citrix services are handled by Citrix. Customer-managed appliances are your responsibility.

What it means for developers and engineering teams

A memory overread on an identity provider is a worst case. The IdP's process memory holds exactly what an attacker wants: session cookies, assertion data and sometimes credentials in transit. Public analyses describe two request patterns: a SAML AuthnRequest to /saml/login with no AssertionConsumerServiceURL, and a request to /wsfed/passive with an empty wctx parameter. Both return leaked memory base64-encoded in the NSC_TASS cookie. Since nothing has to authenticate, every unpatched internet-facing IdP is in range.

Patching stops new leaks but does not undo old ones. A session token stolen before you upgraded is still valid until you kill it, which is the lesson both earlier CitrixBleed waves taught the hard way. For application teams, everything that trusts SAML assertions from that IdP (your internal apps, SaaS tenants, admin panels) inherits the exposure.

What to do now

1. Check whether you're in scope from the NetScaler CLI:

   show runningConfig | grep "add authentication samlIdPProfile"
   show runningConfig | grep -E "add (authentication|vpn) vserver"

   Any output from the first command means CVE-2026-3055 applies.
2. Upgrade to 14.1-66.59, 13.1-62.23 or 13.1-37.262 (FIPS/NDcPP) or later. Builds older than 13.1 are end of life, so plan a migration.
3. Kill existing sessions after upgrading, for example kill aaa session -all and kill icaconnection -all, so leaked tokens stop working.
4. Assume compromise if the IdP was exposed and unpatched after late March 2026. Preserve logs first, then rotate SAML signing keys and certificates, LDAP bind and service-account passwords, and admin credentials.
5. Hunt in logs for unusual volumes of requests to /saml/login and /wsfed/passive, and for admin sessions from unexpected IPs.
6. Review downstream apps that trust the IdP for suspicious logins during the exposure window.

Related on TechLogHub

• Authentication: how SSO and identity providers fit together
• SSL/TLS: the TLS layer NetScaler terminates
• Traefik vs Nginx: open-source reverse proxies, for comparison

Sources

• Citrix security bulletin CTX696300
• CISA Known Exploited Vulnerabilities catalog
• BleepingComputer: CISA orders feds to patch actively exploited Citrix flaw
• Security Affairs: Citrix NetScaler critical flaw could leak data
• Picus Security: Inside the NetScaler CitrixBleed 3 memory overread
• CERT-EU Security Advisory 2026-003
• Qualys ThreatPROTECT: NetScaler CVE-2026-3055 and CVE-2026-4368