CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
Overview
NetScaler ADC and NetScaler Gateway contain an out-of-bounds read flaw in the SAML Identity Provider code paths. When an appliance is configured as a SAML IDP, insufficient input validation allows an unauthenticated remote attacker to send a crafted HTTP request that causes the device to read beyond an intended memory buffer and return kilobytes of process memory to the attacker. Affected builds span the 13.1 and 14.1 release lines across standard, FIPS, and NDcPP variants. Active exploitation was observed in the wild as of late March 2026.
Vulnerability details
The flaw is an out-of-bounds read (CWE-125) in the NetScaler SAML IDP request-handling code. When a query parameter such as wctx is present in a request but carries no value and no equals sign, the code checks only for the parameter's presence before dereferencing the associated buffer pointer. Because no actual data backs that pointer, the read operation accesses uninitialized or adjacent process memory. The same class of weakness affects at least two endpoints: /saml/login and /wsfed/passive. The precondition is that the appliance must be configured as a SAML IDP, confirmed by the presence of an 'add authentication samlIdPProfile' directive in the running configuration.
An attacker sends an unauthenticated HTTP GET request to /wsfed/passive with the wctx parameter present but lacking a value, for example 'GET /wsfed/passive?wctx'. The NetScaler processes the malformed parameter, reads from dead memory, and returns the contents base64-encoded in the NSC_TASS response cookie. Third-party analysis confirms this discloses kilobytes of process memory per request and works reliably. The available sources do not establish whether that memory reliably contains exploitable secrets such as session tokens or private keys. Exploitation requires only network reachability to the SAML IDP endpoints and no authentication.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Inspect NetScaler access logs for GET requests to /saml/login or /wsfed/passive where the wctx parameter is present with no value (no equals sign or trailing data), particularly from sources with no prior authenticated session.
- Monitor HTTP responses from the NetScaler for the NSC_TASS cookie carrying an unusually large base64-encoded payload, which is the specific indicator of successful memory disclosure described in third-party exploitation analysis.
Remediation
Additional hardening
- Upgrade NetScaler ADC and NetScaler Gateway to 14.1-60.58 or later (14.1 line), 13.1-62.23 or later (13.1 line), or 13.1-37.262 or later (13.1 FIPS and NDcPP). See the vendor advisory in References for the full version matrix.
- If the SAML IDP configuration is not operationally required, remove the 'add authentication samlIdPProfile' binding to eliminate the vulnerable code path entirely until patching is complete.
- Restrict network access to the /saml/login and /wsfed/passive endpoints at the perimeter or load-balancer layer so that only known, trusted identity federation partners can reach them.
- Review NSC_TASS cookie values in recent traffic logs for anomalously large base64 payloads, which may indicate prior exploitation and warrant incident response review of potentially exposed session material.
Key dates
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_3055_and_CVE_2026_4368
- https://nvd.nist.gov/vuln/detail/CVE-2026-3055
- https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-3055
Frequently asked questions
Does CVE-2026-3055 affect my FedRAMP authorization?
If Citrix NetScaler runs inside your authorization boundary, yes. CVE-2026-3055 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 2, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your options are to remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-3055?
Knox does not patch your Citrix NetScaler software. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support your documentation for the next assessment. Applying the fix is yours to own; maintaining a defensible compliance posture while you work through it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2026-3055. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at a scheduled review, giving your team time to act before a finding becomes a formal conversation with your agency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-3055's remediation deadline of April 2, 2026 has passed. What happens now?
If CVE-2026-3055 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing it out now and documenting why the deadline was missed is what keeps your authorization standing and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
