CVE-2026-3055

What it actually does

CVE-2026-3055 is an unauthenticated, network-reachable memory overread in NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML Identity Provider. Insufficient validation of attacker-controlled SAML-related input can cause the appliance to read beyond intended memory boundaries and return or process unintended memory contents. Because these devices often sit at the authentication edge, leaked memory may contain sensitive material such as SAML assertions, session identifiers, authentication state, internal request data, configuration fragments, or cryptographic/security tokens, depending on process memory contents at the time of exploitation.

Why it matters to the business

Successful exploitation can expose sensitive authentication data from an internet-facing access gateway, creating risk of account impersonation, unauthorized remote access, data exposure, and disruption to application access. The vulnerability is listed in CISA KEV with a remediation due date of 2026-04-02, has a high EPSS score, and is reported as actively exploited in the wild, including activity associated with an Interlock ransomware campaign; organizations running affected NetScaler ADC or Gateway appliances as SAML identity providers should treat this as urgent even if no outage or visible compromise is apparent.

How an attack unfolds

An attacker first identifies a NetScaler ADC or NetScaler Gateway exposed to the network and determines whether it is acting as a SAML Identity Provider. The attacker then sends specially crafted SAML authentication traffic to the affected SAML IdP endpoints. Because the appliance does not sufficiently validate the supplied input, the request can trigger an out-of-bounds memory read. The attacker repeats or varies the crafted requests to obtain useful memory disclosure. Any recovered authentication artifacts, session material, SAML data, or configuration fragments can then be used to support follow-on activity such as session hijacking, identity impersonation, reconnaissance of protected applications, or broader intrusion. In campaigns where ransomware operators are involved, this type of edge-device flaw may be used as an initial access vector before credential theft, lateral movement, and extortion activity.

How to fix it

Apply the vendor-provided fixed NetScaler ADC and NetScaler Gateway builds as soon as they are available for the affected release branch. Because no exact fixed versions were provided in the input, administrators should consult the current Citrix/NetScaler security bulletin for CVE-2026-3055 and upgrade to the listed fixed build for their appliance line. If immediate upgrade is not possible, reduce exposure by disabling SAML IdP functionality where not required, restricting management and authentication endpoints to trusted networks, enforcing upstream access controls or WAF filtering for SAML endpoints where feasible, and monitoring for abnormal SAML request patterns. Mitigations should be treated as temporary; edge authentication appliances should be upgraded or rebuilt to a fixed version.

How to confirm the fix worked

Confirm whether each NetScaler ADC or NetScaler Gateway is configured as a SAML Identity Provider and whether its running build is listed as affected by the vendor advisory. After remediation, verify the appliance reports a fixed build version, confirm that SAML IdP functionality still works as intended, and retest previously exposed SAML endpoints for expected behavior only. External validation should include checking that only intended endpoints are reachable from untrusted networks and that unauthenticated SAML IdP requests do not produce crashes, anomalous responses, or leaked data. Review configuration backups, HA peers, disaster recovery appliances, and inactive nodes to ensure no affected appliance remains exposed.

Typical attack path

1. Scan the internet or target network ranges for exposed NetScaler ADC or NetScaler Gateway appliances.
2. Fingerprint the device and determine whether SAML IdP functionality is enabled.
3. Send malformed or oversized SAML-related requests to affected SAML IdP endpoints.
4. Trigger the memory overread and collect any leaked response data or side-channel artifacts.
5. Parse recovered memory for session tokens, SAML assertions, credentials, keys, configuration data, internal hostnames, or other sensitive values.
6. Use any recovered authentication material to access protected applications or VPN/gateway sessions.
7. Perform follow-on reconnaissance, persistence, credential theft, or ransomware staging if access is gained.

How to detect it

Hunt across NetScaler appliance logs and downstream identity/application logs for evidence of abnormal unauthenticated SAML IdP traffic, especially malformed, oversized, repeated, or probing requests to SAML endpoints. Relevant sources include HTTP access logs, appliance system logs, authentication logs, SAML/AAA logs, reverse proxy or load balancer logs in front of the appliance, network flow records, packet captures if available, and SIEM records for protected application logins. Look for spikes in requests containing SAMLRequest or SAMLResponse parameters, unusual user agents, requests from scanner infrastructure, repeated failed or anomalous SAML transactions followed by successful access, appliance instability or crashes around SAML traffic, and logins from new geographies or ASNs after suspicious SAML requests. Because memory overread exploitation may not create a distinctive log entry, correlate suspicious SAML requests with subsequent session creation, unusual protected-resource access, privilege changes, credential use, and any ransomware precursor behavior such as discovery, bulk file access, or remote administration tool deployment.

• /var/log/ns.log
• /var/log/httpaccess.log
• /var/log/aaad.debug
• /var/nslog/newnslog
• /saml/idp
• /saml/login
• SAMLRequest=
• SAMLResponse=
• RelayState=
• CitrixADC
• NetScaler
• nsppe
• aaad

What your security team should do

• Immediately inventory all NetScaler ADC and NetScaler Gateway appliances and identify those configured as SAML Identity Providers.
• Prioritize patching or upgrading internet-facing and partner-facing appliances before the CISA KEV due date of 2026-04-02, with emergency handling for any appliance exposed to untrusted networks.
• If patching cannot be completed quickly, temporarily disable SAML IdP functionality where business-acceptable or restrict access to SAML endpoints to trusted source networks.
• Review authentication logs, HTTP access logs, appliance system logs, and downstream application logs for suspicious SAML activity beginning before the published date and continuing to the present.
• Hunt for signs of follow-on access, including unusual successful logins, new sessions from unfamiliar IP addresses, unexpected SAML assertions, and access to protected applications shortly after malformed SAML traffic.
• Rotate potentially exposed secrets where feasible, including SAML signing/encryption material, session-related secrets, and credentials used by integrations if compromise is suspected.
• Consider rebuilding or replacing appliances from trusted media if exploitation is confirmed, because edge-device compromise can be difficult to fully rule out through logs alone.
• Brief incident response and ransomware readiness teams because exploitation has been associated with activity labeled as an Interlock ransomware campaign, even though the KEV ransomware flag is not set.