Critical Memory Overread in Citrix NetScaler ADC & Gateway (CVE‑2026‑3055) Enables Full Appliance Takeover

Critical Memory Overread in Citrix NetScaler ADC & Gateway (CVE‑2026‑3055) Enables Full Appliance Takeover

What It Is — A critical memory‑overread vulnerability (CVE‑2026‑3055) affects Citrix NetScaler ADC and NetScaler Gateway appliances when configured as SAML Identity Providers. The flaw allows unauthenticated attackers to read authentication session IDs and potentially assume full administrative control of the device.

Exploitability — Active exploitation has been observed in the wild since March 27 2026, with threat‑actor IPs targeting vulnerable instances. Public proof‑of‑concept scripts and reconnaissance tools are available, pushing the CVSS score into the Critical range (≥9.0).

Affected Products — Citrix NetScaler ADC and NetScaler Gateway appliances prior to version 14.1‑60.58, and versions older than 13.1‑62.23 / 13.1‑37.262. The vulnerability only impacts on‑premise appliances acting as SAML IDPs.

TPRM Impact —

• Third‑party services that rely on Citrix NetScaler for secure remote access or application delivery may experience credential theft and full service compromise.
• Supply‑chain risk escalates as compromised gateways can be used to pivot into downstream customer environments.

Recommended Actions —

1. Immediately inventory all NetScaler ADC/Gateway instances and verify version compliance.
2. Apply Citrix’s security patch (post‑March 23 2026 bulletin) to all affected appliances.
3. Disable SAML IDP functionality on appliances that do not require it, or migrate to cloud‑based IdP services.
4. Deploy network‑level segmentation and monitor for anomalous traffic to /saml/login and /wsfed/passive endpoints.
5. Run the publicly released Python scanner to identify any remaining vulnerable hosts.

Source: BleepingComputer