Netscaler CVE-2026-3055

NetScaler ADC or NetScaler Gateway configured as SAML Identity Provider (IDP). Remote unauthenticated attacker can send crafted input to SAML endpoint. No victim interaction required. Affects default SAML IDP configurations.

Without published CVSS scores, CVSS vectors, or EPSS metrics, risk assessment must rely on alternative signals. The CWE-125 classification (memory overread) combined with SAML IDP functionality suggests the vulnerability is likely network-accessible and requires minimal privileges, though it may demand medium attack complexity to craft valid SAML structures. The information disclosure nature of memory overread attacks is significant in authentication contexts, as exposed credentials or cryptographic material could enable lateral movement or impersonation. The absence of published CVSS/EPSS data is atypical for a CVE assigned by Citrix, suggesting either very recent disclosure or incomplete public documentation. Given that NetScaler products are critical identity and access control infrastructure used by enterprises worldwide, and considering that SAML IDP exploitation could compromise authentication flows for downstream applications, this should be treated as a high-priority issue regardless of formal scoring. The fact that it affects both ADC and Gateway products across all versions (indicated by wildcards in CPE) amplifies the organizational impact. Organizations should monitor for patch availability and interim guidance from Citrix through the referenced support KB article CTX696300.

An attacker with network access to a NetScaler device configured as a SAML IDP crafts a malformed SAML authentication request containing oversized or specially-formatted fields designed to bypass input validation checks. When the SAML parser processes this request without proper bounds checking, it reads past the allocated input buffer into adjacent memory regions. The attacker exfiltrates this memory content through error messages, response timing, or side-channel observations, potentially revealing session tokens, encryption keys, or other sensitive authentication material. This information is then used to forge SAML assertions or authenticate as legitimate users without correct credentials, compromising the security of applications relying on the affected NetScaler for identity services.