Citrix NetScaler critical flaw could leak data, update now – Security Affairs

Citrix NetScaler critical flaw could leak data, update now

Pierluigi Paganini
March 24, 2026

Citrix warns of a critical NetScaler flaw (CVE-2026-3055) that could leak sensitive data; users are urged to apply security updates immediately.

Citrix issued security updates for two NetScaler vulnerabilities, including a critical memory overread, tracked as CVE-2026-3055 (CVSS score of 9.3), that allows unauthenticated attackers to leak sensitive data.

The flaw CVE-2026-3055 is an insufficient input validation leading to memory overread, it can be triggered only if Citrix ADC or Citrix Gateway are configured as a SAML IDP.

Customers can check if their NetScaler appliance is set up as a SAML IDP by looking for the configuration string:

add authentication samlIdPProfile .*

“This vulnerability, CVE-2026-3055, which is classified as an out-of-bounds read and holds a CVSS score of 9.3, allows unauthenticated…