Cybersecurity defenders are being urged to prioritize updates for Citrix NetScaler ADC and NetScaler Gateway following reports of active reconnaissance and exploitation of a critical vulnerability. The flaw, tracked as CVE-2026-3055, carries a CVSS score of 9.3 and stems from insufficient input validation. This memory overread condition allows unauthorized actors to potentially extract sensitive data from the appliance’s memory, posing a significant risk to organizational confidentiality.
The Mechanics of CVE-2026-3055
The vulnerability primarily impacts NetScaler instances configured as a SAML Identity Provider (SAML IDP). Researchers have identified that the bug involves multiple endpoints, specifically /saml/login and /wsfed/passive?wctx. By sending specially crafted requests that lack specific parameters—such as an empty ‘wctx’ query string or a SAMLRequest missing the AssertionConsumerServiceURL—attackers can trigger the system to return memory contents.
According to technical analysis, the leaked data is often delivered back to the attacker via the NSC_TASS cookie. Because the system fails to verify if the requested data buffer actually contains valid information, it inadvertently points to and exposes “dead memory,” which may contain remnants of previous sessions or other sensitive transaction data.
Evidence of Active Reconnaissance and Exploitation
Security monitoring firms including watchTowr and Defused Cyber have observed threat actors performing fingerprinting activities against Citrix honeypots. These actors typically probe the /cgi/GetAuthMethods endpoint to identify if a target is running a vulnerable SAML IDP configuration. Once a target is confirmed as susceptible, exploitation attempts follow shortly thereafter.
In response to these developments, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog. This designation mandates that federal agencies apply security patches immediately, emphasizing the severity of the threat landscape surrounding this appliance.
Affected Versions and Required Actions
To mitigate this risk, administrators must transition to the latest firmware versions provided by Citrix. The following versions are identified as vulnerable to the memory overread bug:
- NetScaler ADC and Gateway versions prior to 14.1-60.58
- NetScaler ADC and Gateway versions 14.1 before 14.1-66.59
- NetScaler ADC and Gateway versions 13.1 before 13.1-62.23
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.262
Conclusion
The rapid transition from vulnerability disclosure to active exploitation highlights the continued interest threat actors have in edge networking equipment. Given the history of critical bugs affecting the NetScaler platform, such as the previous “Citrix Bleed” incidents, organizations cannot afford to delay. Immediate patching is the only reliable defense against attackers currently scouring the internet for unpatched SAML configurations.