CVE-2026-3055 gives unauthenticated attackers a read window into NetScaler memory

CVE-2026-3055 is a memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to read sensitive data from application memory. Citrix disclosed the flaw on 23 March 2026 in advisory CTX696300. Within days, two independent security firms confirmed that threat actors had begun probing internet-facing NetScaler appliances to identify which ones are vulnerable.

The NVD entry classifies the bug as CWE-125 (out-of-bounds read) and assigns it a CVSS 4.0 base score of 9.3, placing it in the Critical severity band. The attack vector is network-based, requires no privileges, no user interaction and low complexity. In practical terms: anyone who can reach the appliance over the network can attempt exploitation.

What the vulnerability does

The root cause is insufficient input validation in the NetScaler SAML Identity Provider (IDP) processing path. When a NetScaler ADC or Gateway appliance is configured to act as a SAML IDP, malformed requests can trick the parser into reading beyond the intended memory boundary, returning data that should never leave the appliance.

Memory overreads are not new. Heartbleed (CVE-2014-0160) demonstrated a decade ago what happens when an edge device bleeds memory to anyone who asks. The mechanism here is different, but the structural problem is identical: a device that sits at the authentication boundary, handling credentials and session tokens, can be induced to disgorge fragments of its own memory without the attacker needing to execute code.

The SAML IDP configuration requirement narrows the attack surface somewhat. Not every NetScaler deployment uses SAML. But organisations that do tend to be the ones with federated identity architectures serving large user populations. These are not niche configurations.

Active reconnaissance is already underway

According to The Hacker News, both Defused Cyber and watchTowr independently reported active reconnaissance targeting NetScaler appliances within days of the disclosure.

Defused Cyber stated that attackers were probing the /cgi/GetAuthMethods endpoint on NetScaler honeypots. This endpoint reveals which authentication flows are enabled on the appliance. The purpose is clear: if the response indicates SAML IDP is active, the appliance meets the prerequisite for CVE-2026-3055 exploitation.

watchTowr confirmed similar scanning activity in their own monitoring infrastructure.

This sequence matters. Reconnaissance against a specific configuration endpoint is not speculative scanning; it is targeted pre-exploitation activity. The attackers know exactly what they are looking for and are building target lists of appliances that meet the vulnerability's configuration requirements.

Why memory disclosures on edge appliances are different

A memory overread on a web application server is bad. A memory overread on an edge authentication appliance is structurally worse, for reasons that are not always obvious in a CVSS score.

NetScaler ADC and Gateway appliances occupy a privileged position in enterprise networks. They terminate TLS connections, process authentication requests, handle SAML assertions and manage session state. The memory of these devices is a rich target: it may contain SAML tokens, session cookies, plaintext credentials in transit, private key material and internal network configuration details.

Unlike remote code execution, a memory overread does not require the attacker to drop a payload, spawn a shell or establish persistence on the appliance itself. There is no binary to detect, no process anomaly to flag, no file-system modification to trigger an integrity check. The attacker sends a request. The appliance responds with data it should not. From a network perspective, this looks like a normal HTTPS exchange.

This creates a detection blind spot. Organisations that have invested in endpoint detection on their NetScaler appliances (and many have not) are looking for code execution indicators: unexpected processes, modified files, outbound connections to command-and-control infrastructure. A memory overread produces none of these. The appliance behaves normally. It just says too much.

NetScaler's history of edge exploitation

This is not the first time NetScaler has appeared in this position. The device class has a documented history of critical vulnerabilities that attract rapid exploitation:

• CVE-2023-4966 (Citrix Bleed): An information disclosure vulnerability in NetScaler ADC and Gateway that leaked session tokens, enabling session hijacking without credentials. Mandiant confirmed mass exploitation, including by ransomware operators.
• CVE-2023-3519: A remote code execution flaw in NetScaler ADC exploited as a zero-day, with CISA issuing an emergency directive.
• CVE-2025-44501: A stack buffer overflow in NetScaler's packet processing engine that enabled credential harvesting through JavaScript injection into VPN login pages.

The pattern is consistent. NetScaler appliances are high-value targets because they sit at the intersection of authentication, network access and session management. Each new vulnerability in this device class is not an isolated event; it is another chapter in a recurring problem with the security of edge infrastructure.

The CVSS score and what it signals

The CVSS 4.0 vector string for CVE-2026-3055 is notable:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Every base metric is at its most severe setting for the vulnerable component: network attack vector, low complexity, no authentication required, no user interaction, high confidentiality, integrity and availability impact. The 9.3 score reflects that the downstream (subsequent system) impact is rated low, which prevents it from reaching the maximum.

For an information disclosure vulnerability, this is an unusually high score. The CVSS metrics suggest the assessor believes the overread can expose data with high confidentiality impact and that exploitation can also affect integrity and availability of the vulnerable system. This hints at the possibility that the overread is severe enough to leak data that enables further attacks, or that the overread condition itself can be weaponised to disrupt the appliance.

As of 29 March 2026, the NVD entry remains in "Awaiting Analysis" status. The CVSS score was assigned by Citrix as the CNA (CVE Numbering Authority), not by NIST. This is worth noting: the vendor scored their own vulnerability as 9.3. They are not downplaying it.

What defenders should do now

The response here is not complicated, but it is urgent:

1. Patch immediately. Citrix advisory CTX696300 contains the fixed versions. This is a Critical-severity, unauthenticated, network-exploitable vulnerability with confirmed reconnaissance activity. The patch window is closing.

2. Determine SAML IDP exposure. The vulnerability specifically requires the appliance to be configured as a SAML Identity Provider. Organisations should audit their NetScaler configurations to identify which appliances have SAML IDP enabled and prioritise those for patching.

3. Monitor for /cgi/GetAuthMethods probes. The confirmed reconnaissance pattern involves querying this endpoint to enumerate authentication flows. Web application firewall logs and NetScaler access logs should be reviewed for unexpected requests to this path.

4. Assume information may have been exposed. If a vulnerable NetScaler appliance with SAML IDP enabled was internet-facing between the disclosure date and patch application, treat it as potentially compromised. Rotate SAML signing certificates, invalidate active sessions and review authentication logs for anomalous token usage.

5. Review broader edge appliance exposure. This is the latest in a series of critical NetScaler vulnerabilities. Organisations relying on NetScaler for authentication and network access should evaluate whether their patching cadence and monitoring posture for these devices matches the risk they represent.

The quiet ones

Memory overreads do not make headlines the way ransomware does. There is no ransom note, no encrypted file system, no public leak site. An attacker who successfully exploits CVE-2026-3055 walks away with fragments of memory that might contain session tokens, SAML assertions or credential material. They use those fragments to authenticate as someone who is already trusted. The intrusion that follows looks, from every monitoring system's perspective, like a legitimate user doing legitimate things.

The most dangerous vulnerabilities in edge infrastructure are not the ones that give attackers a shell. They are the ones that give attackers an identity.