Critical Citrix NetScaler Vulnerability Exploited in the Wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP CVE-2026-3055 is an out-of-bounds read (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway caused by insufficient input validation when the appliance is configured as a SAML Identity Provider (IDP). An unauthenticated remote attacker can trigger the flaw by sending crafted input to the SAML IDP functionality, causing the appliance to read beyond the bounds of allocated memory and potentially disclose sensitive information from it. The CVSS 4.0 base score of 9.3 (critical) reflects a network-vector flaw requiring no privileges or user interaction. Only organizations running NetScaler ADC or NetScaler Gateway appliances with SAML IDP configured are affected, according to the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-30, carries an 87.2% EPSS probability of exploitation within 30 days, has a public proof-of-concept, and headlines indicate active reconnaissance and exploitation against NetScaler deployments, including federal patch directives. Do: Apply the patched NetScaler ADC and NetScaler Gateway releases from Citrix's advisory as soon as possible, prioritizing internet-facing appliances (exact fixed version numbers are not in this data; check the vendor bulletin). Determine whether SAML IDP is configured on your appliances and, if it is not needed, disable or unbind it as an interim mitigation while reviewing appliance logs for suspicious authentication or reconnaissance traffic. Federal agencies must follow the CISA required action and BOD 22-01 guidance, with CISA directing patching by the stated Thursday deadline. | 9.3 | 87% | KEV PoC |
| largetens of thousands of internet-exposed NetScaler ADC/Gateway appliances, with the directly exposed subset limited to those configured as SAML IDPs |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 14.1.60.52 | cPP Additionally, NetScaler introduced a new feature in its 14.1.60.52 version, called ‘Global Deny List.’ This feature provides a |
Full article649 words · extracted from infosecurity-magazine.com · click to collapse
A critical vulnerability in Citrix’s networking and security solutions is being exploited in the wild, security researchers have confirmed.
The vulnerability, disclosed by Citrix as CVE-2026-3055 on March 23, is a critical out-of-bounds read in NetScaler Application Delivery Controller (ADC) and NetScaler Gateway with a critical CVSS v4.0 score of 9.3.
The two products, formerly known as Citrix ADC and Citrix Gateway, are networking and security solutions used by enterprises to manage, optimize and secure application delivery and remote access.
Identified internally by Citrix’s parent company, the Cloud Software Group, CVE-2026-3055 is due to insufficient input validation leading to memory overread. If exploited, it can enable an unauthenticated remote attacker to leak potentially sensitive information from the appliance's memory.
Specifically, it affects the following versions of both products:
- NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-66.59
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-62.23
- NetScaler ADC FIPS and NDcPP before 13.1-37.262
According to Citrix’s March 23 advisory, these vulnerabilities only affect NetScaler systems explicitly configured as a SAML Identity Provider (SAML IDP). Default or standard configurations remain unaffected.
Additionally, only customer-managed instances are affected, not cloud instances managed by Citrix.
Customers can determine if they have an appliance configured as a SAML IDP Profile by inspecting their NetScaler Configuration for the specified string: “add authentication samlIdPProfile .*.”
Honeypot Activity Shows CVE-2026-3055 Exploitation
After publishing a vulnerability analysis for CVE-2026-3055 on March 28, security researchers at watchTowr quickly confirmed that “in-the-wild exploitation has begun.”
The researchers made the assessment based on evidence from their own honeypot network’s activity, which showed exploitation from known threat actor source IPs as of March 27.
“This is an impressive turnaround time for a vulnerability Citrix identified internally,” they noted.
In parallel, researchers at Defused also reported authentication method fingerprinting activity against NetScaler ADC and NetScaler Gateway in the wild on March 27, noting that this activity was “directly linked” to CVE-2026-3055.
“[Since] CVE-2026-3055 only impacts instances where ADC is configured as an IDP, this fingerprinting is likely identifying exactly that,” they explained.
On March 29, the Defused researchers claimed on X that CVE-2026-3055 is being actively exploited in the wild.
“Attackers send crafted SAMLRequest payloads to /saml/login omitting the AssertionConsumerServiceURL field, triggering the appliance to leak memory contents via the NSC_TASS cookie. Our honeypot data shows exploitation activity from the same payload structure as the Watchtowr proof-of-concept,” they added.
— Defused (@DefusedCyber) March 29, 2026🚨Citrix NetScaler CVE-2026-3055 is being actively exploited in the wild
Attackers send crafted SAMLRequest payloads to /saml/login omitting the AssertionConsumerServiceURL field, triggering the appliance to leak memory contents via the NSC_TASS cookie.
Our honeypot data… pic.twitter.com/G8cgm9dVD9
NetScaler Users Urged to Patch Immediately
WatchTowr, Defused, Citrix parent Cloud Software Group and agencies like the UK’s National Cyber Security Centre (NCSC), have all urge immediate patching of the exploited NetScaler flaw.
The relevant updated versions include:
- NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases
- NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.262 and later releases of 13.1-FIPS and 13.1-NDcPP
Additionally, NetScaler introduced a new feature in its 14.1.60.52 version, called ‘Global Deny List.’ This feature provides a method of adopting an instant-on patch to a running NetScaler without requiring a reboot.
Cloud Software Group said in the March 23 security advisory that Global Deny List signatures for mitigating CVE 2026-3055 were available.
“Please note that to receive signatures meant for the Global Deny List, you must use NetScaler Console (Console On-prem with Cloud Connect or Console Service). Additionally, mitigation via Global Deny List signatures for CVE 2026-3055 is applicable only on 14.1-60.52 and 14.1-60.57 firmware builds,” the company noted.
“We recommend that you adopt fully patched builds as explained above. The Global Deny List feature is meant to be a method of quickly protecting your NetScaler so that upgrades can be done during a scheduled outage window.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/critical-citrix-netscaler/