CVE-2026-3055
Citrix · Published March 23, 2026
9.8
CVSS v3.1
CRITICALCISA KEV — Federal agencies must patch by deadline
Actively exploited in the wild
Patch availableGet patch
Description
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
Affected Products
- Netscaler Application Delivery Controller < 13.1-37.262
- Netscaler Application Delivery Controller < 13.1-62.23
- Netscaler Application Delivery Controller < 14.1-60.58
- Netscaler Gateway < 13.1-62.23
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H