CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read -- SAML IDP Memory Disclosure

Background

Citrix NetScaler (now branded as NetScaler ADC and NetScaler Gateway) is a widely deployed application delivery controller and SSL VPN/access gateway used by enterprises and government organisations to provide load balancing, SSL offloading, application acceleration, and secure remote access. It is a critical piece of network infrastructure, commonly internet-facing, and often serves as the primary remote access gateway for an organisation’s workforce.

When configured as a SAML Identity Provider (IDP), NetScaler handles SAML authentication flows for federated access to applications — a role that places it in the path of sensitive authentication tokens and assertions. Citrix NetScaler has been a consistent high-value target for threat actors: CVE-2023-4966 (Citrix Bleed — session token leak) affected tens of thousands of organisations in 2023, and CVE-2022-27510 (auth bypass) was exploited by multiple groups. CISA added CVE-2026-3055 to the KEV catalogue on 2026-03-30.

Technical Mechanism

CVE-2026-3055 is an out-of-bounds read vulnerability in Citrix NetScaler’s SAML IDP functionality. Out-of-bounds reads occur when code accesses memory beyond the bounds of an allocated buffer — the root cause typically being insufficient length validation before a memory read operation.

In the context of SAML processing, NetScaler parses XML-based SAML request documents, which may contain various fields of variable length (assertion elements, attribute values, signatures). If the parser does not properly validate the length of a field before reading it into a fixed buffer or before using a length value from the document to control a memory read operation, an attacker can craft a SAML request that causes the parser to read beyond the allocated buffer:

1. An attacker sends a crafted SAML authentication request to the NetScaler SAML IDP endpoint (accessible without prior authentication, as initiating SAML authentication is a pre-auth operation)
2. The SAML parser processes the crafted request and reads beyond the bounds of an allocated buffer
3. The out-of-bounds memory region may contain other heap or stack data — potentially including session tokens, cryptographic keys, or other sensitive data resident in memory
4. Depending on the specific memory contents and the exploit’s ability to retrieve them, the impact ranges from information disclosure (memory leakage) to denial of service (crash) to, in some cases, further exploitation if the leaked data enables authentication bypass

The pre-authentication exposure (SAML initiation requires no login) makes this accessible from the internet against any internet-facing NetScaler configured as SAML IDP.

Real-World Exploitation Evidence

CVE-2026-3055 was added to CISA KEV on 2026-03-30. The Citrix NetScaler exploitation ecosystem is mature:

• Nation-state actors — Chinese APT groups attributed to Volt Typhoon and related clusters have targeted Citrix NetScaler in campaigns against government and critical infrastructure
• Ransomware operators — NetScaler vulnerabilities are used for initial access; Citrix Bleed (CVE-2023-4966) was exploited in major ransomware incidents at healthcare organisations in 2023
• Memory disclosure value — in the Citrix context, memory leaks may expose session tokens for authenticated administrative sessions, potentially enabling authentication bypass as was the case with Citrix Bleed
• The SAML IDP configuration is increasingly common as organisations federate application access through NetScaler, expanding the attack surface

Impact Assessment

CVE-2026-3055 affects NetScaler deployments configured as a SAML Identity Provider and is exploitable from the internet without prior authentication, since SAML request initiation is inherently a pre-auth operation. The primary risk from an out-of-bounds read in this context is memory disclosure: heap or stack memory adjacent to the parsing buffer may contain active session tokens, cryptographic key material, or other sensitive data resident in the NetScaler process. If session tokens are leaked, an attacker can hijack authenticated administrative or user sessions without needing valid credentials — the same mechanism that made Citrix Bleed (CVE-2023-4966) so impactful. A denial-of-service outcome from process crash is also possible if the memory read causes an unhandled exception.

With a CVSS score of 8.8 (High, not Critical), this vulnerability is less immediately severe than a direct RCE but remains practically dangerous in the NetScaler context. NetScaler commonly serves as the access gateway for an organisation’s entire remote workforce, and a session token leak could enable authentication bypass into any application federated through the SAML IDP. Healthcare, government, and financial services organisations that rely on NetScaler for SAML-federated access to regulated systems face regulatory exposure in addition to the security risk, since session compromise could satisfy attacker access requirements without any login trail.

Affected Versions

The vulnerability only affects deployments configured as a SAML Identity Provider. Consult the Citrix Security Bulletin CTX-XXXXXX for version details.

Remediation Steps

1. Apply Citrix’s security patch immediately
2. If patching is immediately impossible and the SAML IDP role is not strictly required, temporarily disable the SAML IDP configuration:
   • Reconfigure applications to use an alternate IDP if available
3. Restrict access to the NetScaler management interface (NSIP) to trusted administrator IP ranges
4. Monitor for signs of memory disclosure exploitation — look for unexpected SAML authentication requests with malformed or oversized elements
5. Review NetScaler logs for any signs of session token theft or authentication anomalies following the exposure window
6. If Citrix Bleed-style token theft is suspected (memory disclosure enabling session hijacking), invalidate all active sessions via the NetScaler CLI:

   kill aaa session -all

7. Rotate certificates used for SAML signing if key material may have been in memory during exploitation
8. Review all applications federated through the NetScaler SAML IDP for unexpected access

Detection Guidance

Citrix NetScaler logs — review /var/log/ns.log and SAML-related logs for:

• SAML authentication requests with malformed XML, oversized elements, or unexpected field values
• Repeated SAML requests from the same source IP without successful authentication (scanner/exploit attempt pattern)
• SAML errors that reference memory allocation or parsing failures

Network monitoring:

• Unusual traffic to SAML endpoints (POST to /cgi/samlauth) from unexpected source IP addresses
• High-frequency SAML requests that may indicate automated exploitation attempts

SIEM query example (Splunk):

index=citrix_logs sourcetype=netscaler_syslog
| search "SAML" AND ("error" OR "failed" OR "invalid")
| rex field=_raw "srcip=(?<src_ip>\d+\.\d+\.\d+\.\d+)"
| stats count by src_ip, _time
| timechart span=1h count by src_ip
| where max > 100

Application access monitoring:

• Unexpected access to SAML-federated applications from unusual times, locations, or user agents
• Session activity not correlated with known legitimate users

Timeline

References

• NVD — CVE-2026-3055
• CISA KEV — CVE-2026-3055
• Citrix Security Advisory — CVE-2026-3055