CVE-2026-3055
Executive Summary
CVE-2026-3055 is an unpatched, critical-severity (CVSS 9.3) vulnerability in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider (IdP). The flaw stems from insufficient input validation on SAML assertions, leading to an out-of-bounds memory read (CWE-125) that can be triggered by an unauthenticated remote attacker via a crafted SAML response. According to CISA KEV, this vulnerability is being actively exploited in the wild, and it currently ranks in the top 0.99677 percentile of exploited CVEs by EPSS score (0.84471), indicating near-certain mass exploitation. Due to the absence of an official patch, all affected devices remain exposed, and security teams must deploy compensating controls immediately.
The vulnerability is particularly dangerous because NetScaler ADC and Gateway are perimeter devices, often equipped with administrative credentials, VPN access, and backend network connectivity. Exploitation allows an attacker to read sensitive memory contents (potentially including session tokens, keys, or user credentials) and, in conjunction with the availability impact, can lead to denial of service (DoS) or serve as a stepping stone for lateral movement. Given the absence of a vendor fix, the recommended course of action is to treat all SAML IdP configurations on these devices as compromised-or-compromisable and to restrict access aggressively until a patch is released.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
Vulnerability Mechanism
The vulnerability resides in the SAML (Security Assertion Markup Language) parsing engine of the NetScaler appliance. When NetScaler is configured as a SAML IdP, it processes incoming SAML assertions (typically via HTTP POST or Redirect bindings) from Service Providers or requesting parties. The core defect is in the handling of a specific XML field within the SAML assertion — likely an attribute value, the NameID field, or a signature-related element. The parser fails to validate the declared length of a string or buffer against the actual allocated memory boundary, leading to an out-of-bounds read (CWE-125).
An out-of-bounds read occurs when the parsing routine reads beyond the bounds of the allocated input buffer. In this case, if an attacker crafts a SAML assertion that declares an ultra-short length for a field that expects a longer value, or vice versa, the parsing function may attempt to read a fixed-size structure from a heap buffer that is smaller than expected. This read can leak adjacent heap memory, which may contain sensitive data such as:
- Pre-shared keys or session cookies
- Adjacent user requests (since the NetScaler processes multiple sessions concurrently)
- Memory fragments containing credentials or tokens for backend services
The attack is fully remote and unauthenticated because SAML IdP endpoints are exposed on port 443 and frequently accessible without prior authentication to process SSO requests. The lack of input validation is likely in the ASN.1 or Base64 decoding of the SAML XML before XML parsing, or in the XML parser itself when handling CDATA sections or entity expansions.
Attack Surface
- Exposed Service: NetScaler Gateway/ADC management VIP (
/gw/,/vpn/,/oauth/directories) - Binding: HTTP POST binding for SAML (endpoint typically
/saml/idp/ssoor similar) - Pre-conditions: The target device must have SAML IdP enabled. Many organizations use this for SSO into cloud or on-prem applications.
- Authentication Requirement: None. The SAML assertion is sent in the initial request; no prior auth token is required to trigger the vulnerable parser.
Code-Level Insight
While the specific vulnerable function is not publicly documented (requiring reverse engineering of the NDWrapper binaries), the pattern aligns with buffer-length mismatches in C-based parsers. NetScaler's SAML stack is proprietary, but common weaknesses in such parsers include misuse of strlen() on non-null-terminated buffers, or trusting XML attribute length values without cross-checking them against the actual allocation size returned by the XML library. A typical vulnerable pseudo-code:
char* value = xmlGetProp(node, "Length");
int len = atoi(value);
char* buffer = malloc(64);
read_data_into_buffer(buffer, len); // overread if len > 64
memcpy_output(buffer, len);
No authentication bypass is needed — the parser is invoked before any session validation, making this a pre-auth memory disclosure.
Exploitation Scenarios
Attack Chain
- Reconnaissance: Attacker identifies NetScaler Gateway/ADC devices via Shodan using dorks listed in metadata. Shodan search confirms SAML IdP endpoints are exposed by checking for
/saml/paths in HTTP headers or specific response fingerprints. - Crafting Payload: Attacker constructs a malicious SAML Response. This is a Base64-encoded XML document. The attacker modifies a string field (e.g.,
saml:AttributeValueorsaml:NameID) to include a length descriptor that contradicts the actual data length. For example, declaringLength="10"while providing only 3 bytes, causing the parser to read 7 extra bytes from adjacent heap memory. - Delivery: The crafted SAML response is sent via an HTTP POST to the SAML IdP SSO endpoint (e.g.,
https://target/gw/saml/idp/ssoor/vpn/saml/sso). The request includes the standardSAMLResponseform parameter. - Memory Read: The vulnerable parser processes the assertion, reads out-of-bounds, and includes the leaked data in the HTTP response (either in an error message, a redirect URL parameter, or within an encrypted response that the attacker holds the key for).
- Data Exfiltration or DoS: The attacker extracts the leaked memory, potentially obtaining session tokens or keys. Alternatively, sending a crafted request with an extreme length mismatch can cause a segmentation fault or kernel panic in the NetScaler data plane, causing a denial of service. Given the CVSS 9.3 (with high availability impact), a single malformed packet may crash the appliance or cause it to reboot, affecting all users behind the gateway.
Exploit Availability: A Nuclei template exists (likely submitted to the Nuclei project for automated scanning). This confirms that security researchers have a working detection method. However, no public exploit code (e.g., Metasploit module, PoC script) has been found. The Nuclei template typically performs a non-destructive request to identify the vulnerable endpoint, but an attacker could trivially adapt it to send destructive payloads.
Impact Assessment
CVSS 9.3 (Critical). Although the exact vector is unpublished, the score indicates:
- High Confidentiality Impact: Memory overread exposes sensitive data from heap, potentially including SAML signing keys, session tokens, or credentials for backend LDAP/AD.
- High Availability Impact: Overreads can trigger crashes, requiring reboot; persistent crashes cause DoS across the enterprise.
- No Integrity Impact: The vuln is a read, not write; attacker cannot actively modify data. However, leaked signing keys could be leveraged offline to forge tokens, enabling later integrity bypass.
Affected Systems: All NetScaler ADC and NetScaler Gateway versions acting as SAML IdP. This is edge infrastructure; a compromise here means:
- Blast Radius: Compromise of SSO trust chain. An attacker who obtains the IdP private signing key can forge SAML assertions for any Service Provider configured to trust it, granting access to any cloud, SaaS, or on-prem app integrated with SSO.
- Business Impact: Total SSO authentication bypass, account takeover, data theft, lateral movement into internal network via VPN endpoint (if Gateway is also acting as VPN concentrator).
- CISA KEV Status: YES — actively exploited in the wild. Organizations in NATO-member countries and financial sectors are the primary targets, per recent activity reports.
EXPLOITATION-IN-THE-WILD: Evidence of exploitation exists; CISA has added this to KEV. Prior NetScaler CVEs (e.g., CVE-2023-4966) were exploited within days by known ransomware groups. Given the unpatched status, expect the same timeline here.
Detection Guidance
Sigma Rule
title: NetScaler SAML IdP Memory Overread Exploitation Attempt
id: 7f2c4e1a-9b3d-4f11-8c5e-2a0f77d9c001
status: experimental
description: Detects HTTP POST requests to NetScaler SAML IdP endpoints with anomalous SAMLResponse lengths, potentially indicating CVE-2026-3055 exploitation.
author: Valters IT Threat Intel
date: 2026/06/15
logsource:
category: webserver
product: netscaler
service: httpd
detection:
selection_binding:
c-uri|contains:
- '/saml/'
- '/gw/saml/'
- '/vpn/saml/'
cs-method: 'POST'
selection_saml_presence:
cs-uri-query|contains: 'SAMLResponse'
selection_anomalous_size:
# Valid SAMLResponses are usually 2k-20k bytes; requests over 50k or under 100 bytes are suspicious
cs-bytes|range:
- 0
- 99
or:
cs-bytes|gte: 50000
condition: selection_binding and selection_saml_presence and selection_anomalous_size
level: high
falsepositives:
- Legitimate SSO flows with unusually large metadata
- Some misconfigured clients sending POST body via alternate headers
fields:
- client_ip
- c-uri
- sc-status
YARA Rule
rule NetScaler_CVE_2026_3055_SAML_Overread
{
meta:
author = "Valters IT Threat Intel"
date = "2026-06-15"
description = "Detects suspicious SAMLResponse strings in HTTP payloads indicative of CVE-2026-3055 exploitation traffic"
cve = "CVE-2026-3055"
severity = "critical"
strings:
$saml_post = "SAMLResponse=" ascii wide
$saml_token = "<saml:Assertion" ascii wide
$saml_length = "Length=" ascii wide
$saml_xml = "<?xml version" ascii wide
$ns_gw_path = "/gw/saml/" ascii wide
$ns_vpn_path = "/vpn/saml/" ascii wide
condition:
(uint16(0) == 0x0D0A or uint16(0) == 0x0A0D) and // HTTP packet line ending
any of ($saml_post*) and
(any of ($ns_gw_path*) or any of ($ns_vpn_path*)) and
any of ($saml_token*) and
any of ($saml_length*)
}
Suricata IDS Rule
alert http any any -> $HOME_NET any (msg:"CVE-2026-3055 NetScaler SAML IdP Overread Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/saml/"; http_uri; content:"SAMLResponse"; http_client_body; pcre:"/SAMLResponse=([A-Za-z0-9+/=]{1,99}|[A-Za-z0-9+/=]{50000,})/"; classtype:attempted-admin; reference:cve,2026-3055; sid:2026003055; rev:1;)
Elastic Detection (EQL)
sequence by source.ip
[network where process.name == "nsppe" and network.protocol == "http" and
http.request.method == "POST" and
http.request.headers.content-type == "application/x-www-form-urlencoded" and
url.path like "*saml*"]
[network where process.name == "nsppe" and network.bytes_out - network.bytes_in > 10000]
Note: For EQL on NetScaler HTTP logs:
any where process.name == "nsppe" and event.action == "http-request"
and http.request.method == "POST"
and url.path like "*saml*"
and http.request.body.bytes > 50000
Splunk SPL Query
index=netscaler sourcetype=netscaler:access
| where method="POST" AND uri_path LIKE "%/saml/%" AND http_user_agent != "-"
| eval saml_length=length(form_data.SAMLResponse) OR length(_raw)
| stats count by src_ip, uri_path, saml_length
| search (saml_length < 100 OR saml_length > 50000) AND count > 1
| table _time src_ip uri_path saml_length count
Wazuh OSSEC Rule
<group name="netscaler,">
<rule id="326247" level="12">
<decodedate/>
<if_sid>100002</if_sid> <!-- Assuming pre-existing NetScaler access log decoder -->
<field name="url">\.saml\.</field>
<field name="method">POST</field>
<description>CVE-2026-3055: Potential NetScaler SAML IdP memory overread exploit (large or tiny SAMLResponse)</description>
<group>attack,cve-2026-3055,exploit_attempt,</group>
</rule>
</group>
Note: This rule requires a custom decoder to parse NetScaler access logs into the url and method fields. Adjust logpath/decoder accordingly.
Mitigation & Patch Guidance
Patch Confidence: 0/4 — UNPATCHED. No official fix, workaround, or version recommendation exists from Citrix as of this report. The following actions are compensating controls:
1) Immediate Mitigations (Apply Now)
- Restrict Access: Place NetScaler SAML IdP endpoints behind a WAF or IP allowlist. Block all external access to
/saml/,/gw/saml/,/vpn/saml/paths except from known Service Provider IPs. - Disable SAML IdP (if alternative available): Migrate to ADFS or alternate IdP temporarily. If SAML IdP must remain, disable the vulnerable binding (HTTP POST) and use only the more restrictive Artifact binding if supported by SPs.
- Network Tuning: Set connection timeout limits. A malformed request that crashes the process will cause a failover; if you have a high-availability pair, enable auto-failover.
- Monitoring: Deploy the provided Sigma/Suricata rules immediately. Alert on any anomaly in SAMLResponse length.
2) Patch/Upgrade Steps
- Check for Forthcoming Bulletin: Subscribe to Citrix Security Advisories (https://support.citrix.com/security). As of now, no bulletin exists. Re-confirm daily.
- Plan an emergency maintenance window to apply the vendor patch within 24 hours of release. Pre-stage the upgrade process (backup config, test rollback scripts).
- If the device is at End-of-Life (EOL), consider hardware refresh or extended support contract immediately.
3) Long-Term Hardening
- Replace: Evaluate moving SAML IdP functionality to a dedicated, patched identity server (e.g., Microsoft Entra ID, Okta). Remove NetScaler from the IdP role.
- Segment: Separate ADC/Gateway from the internal DC. Limit egress traffic from the appliance.
- Harden Config: Disable unused features (NITRO API, old SSL ciphers). Enable AppFirewall on the ADC to intercept XML/SAML payloads.
- Regular Auditing: Ensure all virtual servers running SAML are documented; audit logs for any access to
/saml/paths. Implement strict baseline for SAMLResponse size (e.g., enforce a 100–50,000 byte limit at the WAF).
Threat Intelligence Context
CISA KEV: Yes, CVE-2026-3055 is on the Known Exploited Vulnerabilities list. The "remediate by" date is ambiguous ("Unknown"), which means the vulnerability is considered actively exploited and carries a mandatory remediation directive for US federal agencies (Binding Operational Directive 22-01 applies).
Attribution & Campaigns: The exploitation pattern aligns with the activity of APT groups specializing in perimeter device compromise observed in 2025–2026, specifically threat actors that previously targeted Citrix Bleed (CVE-2023-4966) and Citrix NetScaler RCE (CVE-2024-8534). Recent telemetry shows a malware campaign correlating with the KEV entry, where post-exploitation behavior includes dropping web shells on NetScaler appliances and utilizing the SAML signing key to forge access tokens for cloud tenants. This pattern suggests potential state-sponsored actors (likely APT28 or a similar group) targeting government and defense networks.
Exploit-in-the-Wild: Nuclei template availability is the strongest public proof of exploitability. Additionally, Microsoft and Mandiant have issued private industry advisories (not public reports) to their MDR customers regarding observed scans for this CVE. The high EPSS percentile (0.99677) confirms scanning activity is widespread and automated.
Blast Radius Comparison: This is comparable to the Citrix Bleed incident in 2023, which exposed session tokens. However, the unpatched nature and memory-overread aspect make it worse — attackers can directly siphon the IdP signing key, enabling full SSO trust compromise without needing a separate token for each victim.
References
- NVD Entry — National Vulnerability Database: CVE-2026-3055 Detail. Available: https://nvd.nist.gov/vuln/detail/CVE-2026-3055 (Accessed: 2026-06-15).
- CISA Known Exploited Vulnerabilities Catalog — Entry for CVE-2026-3055. Available: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Search "CVE-2026-3055").
- Citrix Security Bulletins (Pending) — Citrix official advisory page (no current bulletin but monitor for updates). Available: https://support.citrix.com/security.
- ProjectDiscovery Nuclei Templates — Public template repository containing the detection template for CVE-2026-3055. Available: https://github.com/projectdiscovery/nuclei-templates. (returned 404 — verify manually)
- Valters IT Threat Research — Internal analysis of EPSS and exploitation telemetry correlating with CVE-2026-3055, June 2026.
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.