CVE-2026-3055

CWE-125 class error (out-of-bounds read) results from insufficient input data validation in the SAML Identity Provider (IDP) handling component. An unauthorized attacker can send a crafted network request that causes data to be read outside the allocated memory buffer. The attack vector is network-based, requires no authentication or user interaction, significantly lowering the barrier to entry for attackers.

Attackers can gain unauthorized access to sensitive data stored in process memory (including credentials, session tokens, cryptographic keys), and depending on implementation — potentially cause device destabilization. The vulnerability threatens system confidentiality, integrity, and operational continuity.

Patches available from the vendor should be applied immediately according to Citrix technical support article CTX696300. Due to active exploitation in production environments and listing in CISA KEV catalog, the update should be deployed as a priority. Until patching, it is recommended to restrict network access to SAML IDP interfaces and monitor logs for anomalous requests.

Citrix NetScaler ADC and Citrix NetScaler Gateway configured in SAML Identity Provider (IDP) role — versions indicated in vendor references (article CTX696300).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.