Executive Summary

On March 23, 2026, Citrix released security updates for a critical vulnerability, CVE-2026-3055, in its NetScaler ADC and NetScaler Gateway products. This flaw, rated 9.3 on the CVSS scale, is an unauthenticated, remote out-of-bounds read vulnerability that can expose sensitive information from an affected device's memory. The vulnerability specifically impacts appliances configured as a SAML Identity Provider (IdP). Due to its similarity to previous high-impact vulnerabilities like CitrixBleed, security experts anticipate that threat actors will rapidly develop exploits. Citrix has also patched a high-severity race condition flaw, CVE-2026-4368. There is no evidence of active exploitation at this time, but immediate patching is strongly recommended for all affected customers to prevent potential data leakage and subsequent network compromise.

Vulnerability Details

The primary vulnerability, CVE-2026-3055, is an out-of-bounds read issue. An unauthenticated attacker can exploit this flaw by sending a specially crafted request to a vulnerable NetScaler appliance. Successful exploitation allows the attacker to read from arbitrary locations in the appliance's memory. This could lead to the disclosure of highly sensitive data, including session authentication tokens, account credentials, and other confidential information. The vulnerability is particularly dangerous because it does not require any authentication or user interaction, making it remotely exploitable against any exposed, vulnerable system.

The flaw is reminiscent of CVE-2023-4966 (CitrixBleed), which was widely exploited by ransomware groups and other threat actors to bypass authentication and gain initial access to corporate networks.

The second vulnerability, CVE-2026-4368, is a high-severity race condition that can cause a "user session mixup" on appliances configured as a Gateway or an AAA virtual server. This could lead to a user improperly gaining access to another user's session, resulting in information disclosure or unauthorized actions.

Affected Systems

The vulnerabilities affect the following product versions:

• NetScaler ADC and NetScaler Gateway: Versions 14.1 before 14.1-66.59
• NetScaler ADC and NetScaler Gateway: Versions 13.1 before 13.1-62.23
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Versions before 13.1-37.262

CRITICAL: CVE-2026-3055 only affects appliances that are configured as a SAML Identity Provider (IdP). Administrators can check their ns.conf file for the string add authentication samlIdPProfile to determine if their appliance is configured as a SAML IdP.

Citrix-managed cloud services and Adaptive Authentication have already been patched by Citrix.

Exploitation Status

As of March 24, 2026, Citrix reports that it discovered the vulnerability through an internal security review and is not aware of any active exploitation in the wild. However, security firms like Rapid7 and watchTowr have warned that exploitation is imminent. Threat actors are known to actively reverse-engineer security patches to develop working exploits, often within hours or days of a patch's release. Given the critical nature of this flaw and its similarity to previously exploited Citrix vulnerabilities, organizations should assume that it will be targeted soon.

Impact Assessment

Successful exploitation of CVE-2026-3055 could have severe consequences. By leaking session tokens from memory, an attacker could bypass multi-factor authentication and gain unauthorized access to protected applications and networks. This would grant the attacker the same level of access as the legitimate user whose token was stolen, enabling lateral movement, data exfiltration, and the deployment of ransomware. The business impact could include significant data breaches, operational downtime, financial loss, and reputational damage. The widespread use of NetScaler for single sign-on (SSO) means a compromise could provide a gateway into numerous other federated corporate applications.

Cyber Observables for Detection

Security teams should proactively hunt for signs of vulnerable configurations and potential exploitation attempts:

Detection & Response

Defenders should focus on identifying vulnerable systems and monitoring for signs of attack.

1. Identify Vulnerable Assets: Use the grep command provided above or vulnerability scanners with updated plugins to identify all NetScaler appliances configured as a SAML IdP.
2. Network Traffic Analysis: Implement enhanced monitoring of traffic to and from NetScaler appliances. Look for anomalous patterns, unexpected data volumes, or connections from unusual geo-locations. Use D3FEND's Network Traffic Analysis to baseline normal traffic and alert on deviations.
3. Log Monitoring: Ingest NetScaler logs (/var/log/ns.log) into a SIEM. Create detection rules to alert on repeated failed login attempts, unexpected successful logins to SAML endpoints, or other error messages indicative of malformed requests.
4. Endpoint Detection: If session hijacking is suspected, correlate NetScaler logs with endpoint activity. Look for user sessions originating from IP addresses that do not match the expected source for that user.

Mitigation

Immediate action is required to mitigate this threat.

1. Patch Immediately: The primary mitigation is to apply the security updates provided by Citrix. Organizations should upgrade to the following or later versions:
   • NetScaler ADC and NetScaler Gateway 14.1-66.59
   • NetScaler ADC and NetScaler Gateway 13.1-62.23
   • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.262
2. Restrict Access: As a compensating control, if patching cannot be immediately performed, restrict network access to the NetScaler management interface. Ensure it is not exposed to the public internet and is only accessible from a trusted management network or via a secure jump host. This is a key D3FEND Network Isolation technique.
3. Disable SAML IdP: If the SAML IdP functionality is not essential, consider disabling it as a temporary measure until patching can be completed. This will remove the vulnerable attack surface.
4. Review and Rotate Credentials: After patching, consider rotating any credentials or secrets that may have been stored in the memory of the appliance as a precautionary measure.