Which versions of Gateway are affected by EUVD-2026-14546?

Citrix NetScaler ADC and Gateway products configured as SAML Identity Providers contain a critical memory overread vulnerability (CVE-2026-3055) that is confirmed actively exploited in the wild,…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-14546?

Yes, a public proof-of-concept exploit is available for EUVD-2026-14546. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-14546?

Within 24 hours: Identify all Citrix NetScaler ADC and Gateway instances configured as SAML Identity Providers in your environment and isolate from internet-facing access if possible. Within 7 days: Apply the vendor-released patch to all affected NetScaler ADC and NetScaler Gateway systems; consult Citrix advisory for affected version ranges and corresponding patch versions. Within 30 days: Conduct memory forensics and access logs on affected systems to detect potential exploitation; reset all SAML-authenticated user sessions and issue password reset notices to users with accounts managed through these identity providers.

Gateway EUVD-2026-14546

Q: What is the CVSS score of EUVD-2026-14546?

EUVD-2026-14546 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-3055 CRITICAL

Out-of-bounds Read (CWE-125)

2026-03-23 NetScaler

GHSA-wv7p-q4p2-p6pf

Buffer Overflow Information Disclosure Citrix Gateway Adc Netscaler

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

66.59,37.262,62.23

Added to CISA KEV

Mar 31, 2026 - 13:18 cisa

CISA KEV

PoC Detected

Mar 31, 2026 - 13:18 vuln.today

Public exploit code

Started Trending

Mar 31, 2026 - 11:23 vuln.today

6.7

EUVD ID Assigned

Mar 23, 2026 - 20:30 euvd

EUVD-2026-14546

Analysis Generated

Mar 23, 2026 - 20:30 vuln.today

CVE Published

Mar 23, 2026 - 20:21 nvd

CRITICAL 9.3

DescriptionCVE.org

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Articles & Coverage 3

POC CVE-2026-3055 NetScaler SAML IdP Memory Overread Detection Tool Apr 01, 2026 labs.watchtowr.com CVE-2026-3055: Citrix NetScaler Memory Overread via SAML IdP XML Parsing labs.watchtowr.com CVE-2026-3055 Part 2: Multiple Memory Overread Vulnerabilities in Citrix NetScaler SAML/WSFED

AnalysisAI

An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, allowing attackers to trigger a memory overread condition. The vulnerability affects both the NetScaler ADC and NetScaler Gateway products across multiple versions, and successful exploitation could lead to information disclosure by reading adjacent memory contents. While no CVSS score or EPSS data is currently published, the CWE-125 classification (Out-of-bounds Read) combined with the SAML IDP configuration context suggests moderate to high real-world risk for organizations relying on these devices for identity management.

Technical ContextAI

The vulnerability resides in the SAML Identity Provider functionality of NetScaler products. SAML (Security Assertion Markup Language) is an XML-based standard for single sign-on and federation. When NetScaler ADC or Gateway is configured as a SAML IDP, it processes SAML authentication requests and generates assertions. The root cause, classified under CWE-125 (Out-of-bounds Read), indicates that the affected code fails to properly validate the length or bounds of user-supplied input before using it in a memory read operation. This could occur during parsing of SAML request parameters, metadata fields, or assertion elements. Attackers can craft malformed SAML requests to cause the parser to read beyond allocated buffer boundaries, exposing adjacent memory regions that may contain sensitive data such as session tokens, cryptographic keys, or other authentication secrets. The CPE identifiers cpe:2.3:a:netscaler:adc:*:*:*:*:*:*:*:* and cpe:2.3:a:netscaler:gateway:*:*:*:*:*:*:*:* indicate that all versions of both products are potentially affected.

RemediationAI

Organizations should immediately consult Citrix KB article CTX696300 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300) to obtain patched versions when they become available and apply updates according to Citrix's guidance. Until patches are deployed, implement the following interim mitigations: restrict network access to NetScaler SAML endpoints to only trusted identity providers and relying parties using firewall rules or network segmentation; disable SAML IDP functionality if not actively required; implement network monitoring and rate limiting on SAML endpoints to detect anomalous request patterns; review SAML request logs for malformed or oversized inputs; and consider placing NetScaler instances behind additional authentication or inspection layers. Organizations with critical dependencies on SAML authentication should prioritize patching once available and consider staging updates in test environments first given the sensitivity of identity infrastructure.