Loading vulnerability…
Unauthenticated Memory Disclosure in Citrix NetScaler SAML Identity Provider
CVE-2026-3055 is an out-of-bounds read vulnerability in Citrix NetScaler ADC and NetScaler Gateway configured as a SAML identity provider, including affected FIPS and NDcPP variants. Insufficient input validation in federated-authentication request processing allows unauthenticated remote attackers to trigger memory overreads using malformed requests. Disclosed process memory can contain sensitive authentication and session information. Exploitation has been observed in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes confidential appliance memory, potentially including authentication cookies and active administrative session data. Valid session material could enable session hijacking and unauthorized access under the affected user's privileges. Confirmed attacks extracted memory from three NetScaler targets and searched it for authentication cookies; successful session hijacking was not established.
If you can’t patch tonight, do this now.
If patching cannot be completed immediately, disable unused SAML identity-provider functionality and restrict external access to affected authentication endpoints. Apply temporary WAF or IPS filtering for malformed federated-authentication requests; these controls do not remove the underlying flaw. Monitor authentication enumeration, malformed SAML requests, empty federation-context parameters, and anomalous response-cookie contents for evidence of reconnaissance or memory disclosure.
Patch, then assume compromise.
Immediately upgrade affected appliances to vendor-fixed releases specified in Citrix security bulletin CTX696300. Fixed releases identified for CVE-2026-3055 include NetScaler ADC and Gateway 14.1-66.59 or later, 13.1-62.23 or later, and NetScaler ADC 13.1-FIPS/NDcPP 13.1-37.262 or later. Select the appropriate supported build for the deployed release branch and appliance variant.
1 exploit validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
333 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.