CVE-2026-3055 - Critical Citrix NetScaler Vulnerability Alert
Basically, a flaw in Citrix products could let hackers access sensitive information.
Citrix has revealed a critical vulnerability, CVE-2026-3055, affecting its NetScaler products. Organizations using these systems are at risk of data leaks. Immediate action is required to secure sensitive information from potential attacks.
The Flaw
On March 23, 2026, Citrix announced a critical vulnerability, CVE-2026-3055, affecting its NetScaler ADC and NetScaler Gateway products. This vulnerability, classified as an out-of-bounds read, holds a CVSS score of 9.3, indicating a high severity level. It allows unauthenticated remote attackers to leak potentially sensitive information from the appliance's memory. The flaw primarily impacts systems configured as a SAML Identity Provider (SAML IDP), a common setup for organizations using single sign-on.
The advisory specifies that default configurations are not affected. Organizations can check if they are vulnerable by inspecting their NetScaler Configuration for the string: add authentication samlIdPProfile .*. This proactive step can help identify at-risk systems before exploitation occurs.
What's at Risk
CVE-2026-3055 affects specific versions of NetScaler ADC and NetScaler Gateway. The vulnerable versions include 14.1 before 14.1-66.59 and 13.1 before 13.1-62.23, along with 13.1-FIPS and 13.1-NDcPP before 13.1-37.262. Notably, customer-managed instances are at risk, while cloud instances managed by Citrix are safe. Given the history of similar vulnerabilities, such as the CitrixBleed incident in 2023, the potential for exploitation is significant.
Patch Status
As of the advisory's release, there is no evidence of in-the-wild exploitation or public proof-of-concept (PoC) code. However, the risk increases as exploit code becomes available. Citrix urges affected customers to upgrade their systems to the patched versions without delay. The fixed versions include:
- 14.1 fixed in 14.1-66.59
- 13.1 fixed in 13.1-62.23
- 13.1-FIPS and 13.1-NDcPP fixed in 13.1-37.262
Immediate Actions
Organizations using affected Citrix products should prioritize immediate upgrades to mitigate the risks associated with CVE-2026-3055. Regularly checking for updates and following the vendor's guidance is crucial. Rapid7 customers can assess their exposure through an authenticated vulnerability check, which will be available shortly after the advisory's publication. Taking these steps can significantly reduce the risk of data leakage and maintain the integrity of sensitive information.
Rapid7 Blog