{"id":"citrix-netscaler-memory-disclosure-mar-2026","category":"patch","status":"closed","title":"Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available","tldr":"Attackers exploited CVE-2026-3055 to read sensitive memory from NetScaler appliances providing SAML sign-in. Supported branches have fixes. Ask your organisation's IT provider to update affected appliances and investigate possible compromise.","summary":"CVE-2026-3055 lets an attacker without a login read sensitive information from memory on customer-managed Citrix NetScaler ADC and Gateway appliances configured to provide SAML sign-in. Citrix disclosed it on 23 March; Canada's Cyber Centre cited exploitation from 27 March, and CISA listed it as exploited on 30 March. This is a memory disclosure flaw, rather than the memory corruption described in the initial brief. Citrix provides fixes for every affected supported branch, including a separate 14.1-60.58 build confirmed in its revised bulletin. Citrix-managed cloud services were updated by the provider. As at 3 November, the reviewed reporting establishes neither a victim count nor that attacks have stopped.","action":"If your workplace or family office uses NetScaler, ask its IT provider to install a current supported release containing the fixes: 14.1-66.59, 13.1-62.23 or FIPS/NDcPP 13.1-37.262; Citrix also lists 14.1-60.58 as fixed. Ask them to investigate suspected compromise and revoke exposed access or credentials, rather than relying on an update alone.","product":"Citrix NetScaler ADC and NetScaler Gateway","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-3055"],"tags":["citrix","netscaler","gateway","memory-disclosure","actively-exploited"],"affected":["Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-60.58, configured as a SAML identity provider","Customer-managed NetScaler ADC and NetScaler Gateway 13.1 before 13.1-62.23, configured as a SAML identity provider","Customer-managed NetScaler ADC FIPS and NDcPP before 13.1-37.262, configured as a SAML identity provider"],"fixed":["NetScaler ADC and NetScaler Gateway 14.1-60.58","NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases","NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1","NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.262 and later releases of those branches"],"matches":[],"sources":[{"kind":"advisory","title":"NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368","url":"https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","date":"2026-03-23"},{"kind":"advisory","title":"AL26-006 — Vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway — CVE-2026-3055","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-006-vulnerability-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2026-3055","by":"Canadian Centre for Cyber Security","date":"2026-03-30"},{"kind":"advisory","title":"Citrix security advisory (AV26-267) — Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-267","by":"Canadian Centre for Cyber Security","date":"2026-03-30"},{"kind":"news","title":"Critical Citrix NetScaler memory flaw actively exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/critical-citrix-netscaler-memory-flaw-actively-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-30"},{"kind":"news","title":"CISA orders feds to patch actively exploited Citrix flaw by Thursday","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-citrix-flaw-by-thursday/","by":"BleepingComputer","date":"2026-03-31"}],"started":"2026-03-23","closed":"2026-03-31","created":"2026-11-03T22:26:43.153Z","updated":"2026-11-03T22:26:43.153Z","cve_notes":[{"cve":"CVE-2026-3055","name":"Memory disclosure in NetScaler SAML sign-in","what":"Insufficient input validation in NetScaler ADC and Gateway configured as a SAML identity provider lets a remote attacker without a login read sensitive information from memory.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-03-31","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"BleepingComputer reported that CISA required US federal civilian agencies to secure affected appliances by 2 April. The number of vulnerable or compromised appliances remained unknown.","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-citrix-flaw-by-thursday/","by":"BleepingComputer","patch":null},{"at":"2026-03-30","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities catalogue.","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-267","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-27","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Exploitation was observed from this date, according to research subsequently cited by Canada's Cyber Centre.","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-006-vulnerability-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2026-3055","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-23","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Citrix revised its affected-version guidance and confirmed that 14.1-60.58 also fixes the flaw, alongside 14.1-66.59.","url":"https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","patch":null},{"at":"2026-03-23","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Citrix disclosed CVE-2026-3055 and published fixed releases. The flaw affects appliances configured as SAML identity providers.","url":"https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","patch":"patched"}],"url":"https://hard.fyi/live/citrix-netscaler-memory-disclosure-mar-2026/","json":"https://hard.fyi/api/live?id=citrix-netscaler-memory-disclosure-mar-2026"}