Citrix has released essential patches for a critical vulnerability affecting its NetScaler ADC and NetScaler Gateway products. The flaw, identified as CVE-2026-3055, is a significant security risk due to its potential to cause sensitive memory leaks.
Understanding the Vulnerability
The vulnerability in question is characterized as an out-of-bounds read issue, specifically impacting NetScaler configurations set up as a SAML Identity Provider (SAML IDP). It carries a substantial CVSS score of 9.3, indicating its severity. Citrix advises customers to check their systems for the presence of a SAML IDP Profile by looking for the specific configuration string: add authentication samlIdPProfile .*.
Patch Details and Additional Fixes
Security fixes have been rolled out in several versions of NetScaler ADC and NetScaler Gateway, including 14.1-66.59, 13.1-62.23, and 13.1-NDcPP 13.1.37.262. Besides CVE-2026-3055, these updates also address CVE-2026-4368, a high-severity race condition that could result in ‘user session mixup’ when devices are configured as gateways or AAA virtual servers.
Expert Warnings and Potential Exploitation
Although Citrix’s security assessments discovered these vulnerabilities and no current exploits in the wild have been reported, experts like Benjamin Harris, CEO of watchTowr, urge immediate patching. Harris likens CVE-2026-3055 to past vulnerabilities, CitrixBleed and CitrixBleed2, which have been problematic for many users. He warns that the flaw could enable unauthorized attackers to access sensitive data from vulnerable systems.
Security firm Rapid7 also highlights the risk, noting that the SAML IDP configuration required for exploitation is widespread in organizations using single sign-on solutions. They anticipate that attacks might commence once a public exploitation code is available.
Urgent Action Required
With NetScaler solutions frequently targeted for unauthorized access, it is crucial for enterprises to act swiftly. Security experts recommend immediate application of the patches to mitigate the risk of imminent exploitation. Organizations running susceptible versions should prioritize these updates to safeguard their environments against potential threats.
Related: QNAP Patches Four Vulnerabilities Exploited at Pwn2Own
Related: Oracle Releases Emergency Patch for Critical Identity Manager Vulnerability
Related: Apple Debuts Background Security Improvements With Fresh WebKit Patches
Related: Citrix Patches Exploited NetScaler Zero-Day
