Citrix NetScaler – Memory Leak with SAML IdP and Session Mix-Up (CVE-2026-3055/4368)
Two vulnerabilities in Citrix NetScaler ADC and Gateway: if the appliance is configured as a SAML identity provider, attackers can read sensitive data from memory – this flaw is actively exploited. A second flaw can mix up user sessions on one specific build.
Update of October 22, 2026
We have corrected this advisory: the patch versions previously listed were wrong. The versions from Citrix bulletin CTX696300 (below) apply. In addition, CVE-2026-3055 only affects appliances with a SAML IdP configuration, and according to Citrix CVE-2026-4368 only affects build 14.1-66.54. CVE-2026-3055 is now listed in the US agency CISA's catalog of known exploited vulnerabilities.
What happened?
On March 23, 2026, Citrix published two vulnerabilities in NetScaler ADC and Gateway:
- CVE-2026-3055 (CVSS 9.3): Insufficient input validation causes NetScaler to return more data from memory than intended. This can leak session tokens, keys or other secrets. Only appliances configured as a SAML identity provider (SAML IdP) are affected. The flaw is actively exploited.
- CVE-2026-4368 (CVSS 7.7): A race condition can mix up user sessions, so that one user ends up in another user's session. According to Citrix, only build 14.1-66.54 is affected, when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Who is affected?
- CVE-2026-3055: NetScaler ADC and Gateway 14.1 before 14.1-60.58, 13.1 before 13.1-62.23 and 13.1-FIPS/NDcPP before 13.1-37.262 – in each case only with a SAML IdP configuration. You can check by searching the configuration for
add authentication samlIdPProfile. - CVE-2026-4368: Only build 14.1-66.54 with a Gateway or AAA configuration (
add vpn vserveroradd authentication vserver). - Unsupported versions such as 12.1 and 13.0 receive no security updates and should be replaced.
What needs to be done?
- Update: Upgrade to 14.1-60.58, 14.1-66.59 or later, 13.1-62.23 or later, or 13.1-FIPS/NDcPP 13.1-37.262 or later. Citrix-managed cloud services have been updated by the vendor.
- Terminate sessions: Since session tokens may have leaked through CVE-2026-3055, we recommend terminating all active sessions after the update as a precaution (e.g.
kill icaconnection -all) and forcing users to log in again. - Check for compromise: If the appliance ran as a SAML IdP and was patched late, review the logs for unusual logins and sessions.
- Protect management access: Make sure the management interface (NSIP) is not reachable from the internet.
- Review MFA: Check that multi-factor authentication is enabled everywhere to reduce the risk from stolen session tokens.
This advisory is for informational purposes. Contact us for assistance securing your Citrix infrastructure.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call