Citrix NetScaler CVE-2026-3055 memory overread exploited on SAML IdP appliances

CVE-2026-3055, a critical memory overread in Citrix NetScaler ADC and NetScaler Gateway, went from disclosure to in-the-wild exploitation in four days in March 2026. Appliances configured as a SAML Identity Provider can leak chunks of memory to unauthenticated requests, and researchers showed that leak can include an administrator's session ID. Anyone who remembers CitrixBleed in 2023 will recognise the pattern: patching isn't enough while stolen sessions are still valid.

What happened

On 23 March 2026 Citrix published security bulletin CTX696300 covering two flaws:

• CVE-2026-3055 (CVSS 9.3): insufficient input validation leading to an out-of-bounds memory read. It only affects appliances configured as a SAML IdP.
• CVE-2026-4368 (CVSS 7.7): a race condition that can mix up user sessions on appliances configured as a Gateway or AAA virtual server. It only affects build 14.1-66.54.

Researchers at watchTowr found that CVE-2026-3055 actually covers at least two separate overread bugs, reachable at /saml/login and /wsfed/passive. The second is triggered by a wctx query parameter with no value and no = sign. Leaked memory, typically kilobytes per request and different each time, comes back Base64-encoded in the NSC_TASS cookie. In watchTowr's testing, the leaked memory included an authenticated administrative session ID that let them act as an administrator. Defused Cyber separately saw crafted SAMLRequest payloads with no AssertionConsumerServiceURL sent to /saml/login.

watchTowr's honeypots recorded exploitation from known threat-actor IP addresses from 27 March. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog on 30 March and gave US federal civilian agencies until 2 April to patch.

Who is affected

• Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-66.59, 13.1 before 13.1-62.23, and 13.1-FIPS/NDcPP before 13.1-37.262.
• Only appliances configured as a SAML IdP are exposed to CVE-2026-3055. Default configurations aren't. You can check by searching the running configuration for add authentication samlIdPProfile.
• Citrix-managed cloud services and Adaptive Authentication instances were updated by Citrix.

What it means for developers and engineering teams

When NetScaler acts as a SAML IdP, it's the system that signs the identity assertions your applications trust. A memory leak on that appliance can expose session material for the appliance itself and possibly for the users authenticating through it. An attacker who replays a leaked admin session doesn't need a password or MFA, and could change authentication policies or capture credentials for every downstream app.

This is the same class of bug as CitrixBleed (CVE-2023-4966): an unauthenticated over-read on an edge device that hands out session tokens. The lesson from 2023 still applies. Sessions stolen before you patched keep working afterwards until they're terminated, so patching and killing sessions have to happen together.

The companion bug, CVE-2026-4368, is a different kind of failure. Under a race condition, an authenticated Gateway or AAA session can be tied to another user's context, so one user may end up with access to someone else's resources. It only affects build 14.1-66.54, so it mostly matters to teams that installed that particular build. Session-handling races like this are hard to catch in testing, which is why they tend to show up in appliance firmware rather than in application logs.

For application teams behind a NetScaler IdP, the risk is indirect but real. Check whether your apps accept long-lived SAML sessions, and whether you could force re-authentication across the board if your IdP were compromised.

What to do now

1. Check exposure: search ns.conf for add authentication samlIdPProfile (CVE-2026-3055) and add vpn vserver / add authentication vserver (CVE-2026-4368), and confirm your build with show ns version.
2. Upgrade to 14.1-66.59, 13.1-62.23 or 13.1-37.262 (FIPS/NDcPP) or later. Citrix's Global Deny List signatures are only a stopgap on specific 14.1 builds.
3. Terminate existing sessions after patching, as Citrix advised for CitrixBleed, for example kill aaa session -all and kill icaconnection -all, and rotate admin credentials.
4. Test patch status with watchTowr's published detection script. A patched appliance should return a plain redirect instead of an NSC_TASS cookie holding memory.
5. Hunt for abuse: review admin logins and configuration changes since 23 March, especially changes to authentication or SAML policies.
6. Force re-authentication in downstream applications that trust the NetScaler IdP if you find signs of compromise.

Related on TechLogHub

• Authentication: SSO, sessions and identity providers
• SSL/TLS: what edge appliances terminate

Sources

• Citrix CTX696300: NetScaler ADC and Gateway security bulletin for CVE-2026-3055 and CVE-2026-4368
• watchTowr Labs: CVE-2026-3055 memory overread, part 2
• watchTowr Labs: CVE-2026-3055 memory overread, part 1
• The Hacker News: Citrix NetScaler under active recon and exploitation
• Infosecurity Magazine: Critical Citrix NetScaler flaw exploited
• NVD: CVE-2026-3055