Critical Out‑of‑Bounds Read (CVE‑2026‑3055) in Citrix NetScaler/ADC SAML IDP Enables Data Leakage – Added to CISA KEV Catalog
What It Is – A critical memory‑overread vulnerability (CVE‑2026‑3055) in Citrix NetScaler (also marketed as Citrix ADC or Citrix Gateway) when the appliance is configured as a SAML Identity Provider. The flaw allows unauthenticated remote attackers to read arbitrary memory, potentially exposing sensitive data.
Exploitability – No public proof‑of‑concept or in‑the‑wild exploit has been observed yet, but the vulnerability scores 9.3 (CVSS 4.0) and is listed in the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog, indicating a high likelihood of exploitation once exploit code surfaces.
Affected Products – Citrix NetScaler / Citrix ADC / Citrix Gateway appliances running versions vulnerable to CVE‑2026‑3055 (and the related CVE‑2026‑4368 race condition). Only installations configured as a SAML IdP are impacted; default configurations remain safe.
TPRM Impact –
- Third‑party services that rely on Citrix NetScaler for SAML‑based single sign‑on may inherit the data‑leak risk, exposing downstream customers.
- Federal and regulated private entities are mandated to remediate by 2 April 2026, creating compliance pressure for supply‑chain partners.
Recommended Actions –
- Verify whether any NetScaler/ADC appliances are operating as a SAML IdP (
add authentication samlIdPProfile .*). - Apply Citrix’s March 2026 security updates immediately to remediate CVE‑2026‑3055 and CVE‑2026‑4368.
- For organizations under CISA BOD 22‑01, document remediation by the April 2 deadline and report compliance.
- Conduct a risk assessment of any downstream services that consume the affected appliance for authentication.
- Monitor threat intel feeds for emerging exploit code and be prepared to enforce additional network segmentation or WAF rules.