CRITICAL Actively exploited CWE-125
CVE-2026-3055
Insufficient input validation leading to memory overread
Citrix·NetScaler
9.3/ 10
CVSS 4.0
Critical severity
91%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.8% of all CVEs
Listed
CISA KEV catalog
- Added
- Mar 30, 2026
- Fix due
- Apr 2, 2026
- Ransomware
- Not known
Timeline
- Published
- Mar 23, 2026
- Updated
- Mar 31, 2026
- First covered
- Jul 31, 2026
- Latest story
- 4 months ago
Summary
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
CWE-125Out-of-bounds Read
Attack profile
Attack vectorNetwork
ComplexityLow
RequirementsNone
PrivilegesNone
User interactionNone
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:LCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- NetScaler ADC14.1 to before 66.5913.1 to before 62.2313.1 FIPS and NDcPP to before 37.262
- NetScaler Gateway14.1 to before 66.5913.1 to before 62.23