# CVE-2026-3055: Citrix NetScaler out-of-bounds read in SAML IdP

Source: https://junglewise.ai/threats/cve-2026-3055-citrix-netscaler-out-of-bounds-read-in-saml-idp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-30. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-3055 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-03-30

Citrix NetScaler ADC and Gateway appliances, which manage network traffic and remote access, contain a critical vulnerability when used for single sign-on (SAML). An attacker can remotely access sensitive information from the device's memory, potentially leading to full system compromise or data theft. This vulnerability is actively being exploited in the wild, making immediate patching essential to protect corporate networks.

Technologies: [Citrix NetScaler](https://junglewise.ai/threats/technologies/netscaler), [Citrix NetScaler ADC](https://junglewise.ai/threats/technologies/netscaler-adc), [Citrix NetScaler Gateway](https://junglewise.ai/threats/technologies/gateway). Vendors: [Citrix](https://junglewise.ai/threats/vendors/citrix).

## Quick answers

**Is CVE-2026-3055 exploited in the wild?** Yes. CVE-2026-3055 is known to be exploited in the wild, first recorded on 30 March 2026. Treat it as urgent.

**How severe is CVE-2026-3055?** Critical severity, with a CVSS score of 9.8, published 30 March 2026.

**Which products and versions are affected?** Citrix NetScaler ADC 13.1 before 13.1-62.23, 14.1 before 14.1-60.58, 13.1 FIPS before 13.1-37.262, 13.1 NDcPP before 13.1-37.262; Citrix NetScaler Gateway 13.1 before 13.1-62.23, 14.1 before 14.1-60.58.

**Is there a fix for CVE-2026-3055?** A patch was published on 2026-03-31: NIST updated with specific patched version ranges Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3055 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-3055?** Check whether you run Citrix NetScaler, Citrix NetScaler ADC or Citrix NetScaler Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in Citrix NetScaler ADC and Gateway due to insufficient input validation when the device is configured as a SAML Identity Provider (IdP). A remote, unauthenticated attacker can exploit this flaw over the network to read sensitive data from the appliance's memory. This memory overread can potentially lead to the disclosure of session tokens, private keys, or other sensitive information, facilitating further compromise. The vulnerability is confirmed to be exploited in the wild and affects multiple versions including 13.1 and 14.1; patches are available from the vendor.

## Affected products

- Citrix NetScaler ADC 13.1 before 13.1-62.23, 14.1 before 14.1-60.58, 13.1 FIPS before 13.1-37.262, 13.1 NDcPP before 13.1-37.262
- Citrix NetScaler Gateway 13.1 before 13.1-62.23, 14.1 before 14.1-60.58

## Timeline

- 2026-03-23: disclosed: Initial CVE entry received from NetScaler
- 2026-03-30: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2026-03-30: advisory: Vendor advisory CTX696300 published
- 2026-03-31: patched: NIST updated with specific patched version ranges

## Related threats

- [Citrix NetScaler ADC memory overflow in LDAP authentication](https://junglewise.ai/threats/cve-2026-111342-memory-overflow-in-ldap-authentication-can-lead-to-unpredictable)
- [Citrix NetScaler memory overflow in client-certificate authentication](https://junglewise.ai/threats/cve-2026-111341-memory-overflow-in-client-certificate-authentication-can-lead-to)
- [Citrix NetScaler memory overflow in KBA authentication](https://junglewise.ai/threats/cve-2026-111340-memory-overflow-in-kba-knowledge-based-authentication-can-lead)
- [Citrix NetScaler ADC memory overflow in Email OTP authentication](https://junglewise.ai/threats/cve-2026-107415-memory-overflow-in-email-otp-authentication-can-lead-to)
- [Citrix NetScaler ADC memory overflow in WebAuth authentication](https://junglewise.ai/threats/cve-2026-107414-memory-overflow-in-webauth-authentication-can-lead-to)