Critical Vulnerability - Citrix NetScaler ADC and Gateway

The Flaw

On March 30, 2026, the Canadian Centre for Cyber Security issued an alert regarding a critical vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-3055. This vulnerability arises from insufficient input validation, leading to a memory overread. Essentially, this means that an attacker could exploit this flaw to access sensitive data stored in memory without needing authentication.

For this vulnerability to be exploited, the affected systems must be configured as a SAML Identity Provider (IdP). This specific setup is common in many organizations that utilize Citrix for secure remote access. The Cyber Centre noted that the exploitation of this vulnerability has already been observed in the wild since March 27, 2026, making it crucial for organizations to take immediate action.

What's at Risk

The implications of this vulnerability are significant. If successfully exploited, an attacker could gain access to sensitive information, potentially leading to data breaches or further attacks within an organization. This risk is particularly high for organizations that manage their own NetScaler ADC and Gateway systems, as they may not have the same level of automatic updates as Citrix-managed services.

Organizations using these appliances should be particularly vigilant, especially if they are configured as SAML IdPs. The Cyber Centre has emphasized the importance of understanding how this vulnerability could impact your specific configurations and the data at risk.

Patch Status

Citrix has responded to this vulnerability by releasing updates for affected versions. Organizations are urged to upgrade to the following versions:

• NetScaler ADC and Gateway 14.1-60.58 and later for version 14.1
• NetScaler ADC and Gateway 13.1-62.23 and later for version 13.1
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.262 and later for FIPS and NDcPP versions.

For organizations that suspect their systems may have been compromised, Citrix has provided guidance on preserving evidence and isolating affected machines. This includes avoiding powering down the machine to preserve traces for investigation and revoking access credentials immediately.

Immediate Actions

Organizations should take proactive steps to mitigate the risks associated with this vulnerability. Here are some recommended actions:

• Review the Citrix security bulletin for detailed information on the vulnerability and updates.
• Upgrade affected systems to the latest secure versions as soon as possible.
• Isolate compromised machines from the network to prevent further unauthorized access.
• Implement the Cyber Centre’s Top 10 IT Security Actions, focusing on patching, hardening systems, and isolating web-facing applications.

If any suspicious activity is detected, organizations are encouraged to report it through the Cyber Centre’s My Cyber Portal or via email. Taking these steps will help safeguard sensitive information and maintain the integrity of your systems.