CVE-2026-3055

Critical9.8Published on March 23, 2026

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Actively exploited

  • In the CISA exploited-vulnerabilities catalogue since Mar 30, 2026
  • US federal agencies must remediate it by Apr 2, 2026 (BOD 22-01)
  • First attack observed 5 days after disclosure
  • Confirmed by sensors, not only by reports

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Sep 16, 2026 Sep 15, 2026 Sep 14, 2026 Sep 13, 2026 Sep 12, 2026 Sep 11, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness type (CWE)CWE-125
Vendorscitrix

Affected products

VendorsProductVersions
citrixnetscaler application delivery controller< 13.1-37.262
citrixnetscaler gateway< 13.1-62.23

Related articles

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database