What’s Vulnerable › Vulnerabilities

CVE-2026-3055: Insufficient input validation leading to memory overread

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-03-30
• EPSS: 91.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-125

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Summary

CVE-2026-3055 is a critical (CVSS 9.8) out-of-bounds read in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML IDP, caused by insufficient input validation leading to memory overread. It is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit or detection template exists, and EPSS estimates a 91.5% probability of exploitation in 30 days. Affected are NetScaler ADC (fixed in 13.1-37.262, 13.1-62.23, 14.1-60.58) and NetScaler Gateway (fixed in 13.1-62.23, 14.1-60.58). Apply the fixed versions or vendor mitigations immediately, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

CVE-2026-3055 هو ثغرة قراءة خارج الحدود (out-of-bounds read) حرجة بدرجة CVSS 9.8 في Citrix NetScaler ADC وNetScaler Gateway عند تكوينهما كـ SAML IDP، بسبب تحقق غير كافٍ من المدخلات يؤدي إلى قراءة زائدة من الذاكرة (memory overread). الثغرة مدرجة في كتالوج CISA للثغرات المعروفة المستغلة مع استغلال نشط، ويوجد استغلال عام أو قالب كشف، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 91.5%. المنتجات المتأثرة هي NetScaler ADC (تم إصلاحها في 13.1-37.262 و13.1-62.23 و14.1-60.58) وNetScaler Gateway (تم إصلاحها في 13.1-62.23 و14.1-60.58). طبّق الإصدارات المُصلحة أو تخفيفات المورّد فوراً، واتبع إرشادات BOD 22-01 لخدمات السحابة، أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Citrix NetScaler ADC: from 13.1 before 13.1-62.23; from 14.1 before 14.1-60.58 — fixed in 13.1-62.23, 14.1-60.58
• Citrix Netscaler Application Delivery Controller Fips: from 13.1 before 13.1-37.262 — fixed in 13.1-37.262
• Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1-37.262 — fixed in 13.1-37.262
• Citrix NetScaler Gateway: from 13.1 before 13.1-62.23; from 14.1 before 14.1-60.58 — fixed in 13.1-62.23, 14.1-60.58
• NetScaler ADC: from 14.1 before 66.59; from 13.1 before 62.23; from 13.1 FIPS and NDcPP before 37.262 — fixed in 66.59, 62.23, 37.262
• NetScaler Gateway: from 14.1 before 66.59; from 13.1 before 62.23 — fixed in 66.59, 62.23

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-62.23, 14.1-60.58; Citrix Netscaler Application Delivery Controller Fips 13.1-37.262; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.262; Citrix NetScaler Gateway 13.1-62.23, 14.1-60.58; NetScaler ADC 66.59, 62.23, 37.262; NetScaler Gateway 66.59, 62.23. Check the vendor advisory for mitigations.

In the news

• CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
• Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread Part 2)

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
• https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055

Get alerted when CVE-2026-3055 or the next vulnerability affects your stack