CVE-2026-3055: Citrix NetScaler Critical Flaw Leaks Sensitive Memory — Patch Immediately Before Exploitation Begins

CVE-2026-3055 is an out-of-bounds read vulnerability caused by insufficient input validation in NetScaler's SAML Identity Provider implementation. When an unauthenticated attacker sends a crafted request to a NetScaler appliance configured as a SAML IDP, the appliance reads beyond the boundaries of allocated memory — exposing raw memory contents that may include session tokens, credentials, cryptographic keys, or other sensitive data stored in the appliance's working memory. This is the same class of vulnerability that made Citrix Bleed — CVE-2023-4966 — one of the most exploited information security vulnerabilities of 2023. Citrix Bleed enabled attackers to steal session tokens and bypass authentication entirely on thousands of enterprise NetScaler deployments globally. CVE-2026-3055 requires the SAML IDP configuration to be active, which is not the default state — but SAML IDP is extremely common in enterprise environments because it powers single sign-on for Microsoft, Google, Okta, and virtually every major identity provider integration. The second vulnerability, CVE-2026-4368, is a race condition in appliances configured as SSL VPN gateways, ICA Proxies, CVPN, RDP Proxies, or AAA virtual servers. A low-privilege attacker who exploits the timing window can cause session mixup — accessing another user's active session and inheriting their identity and access rights within that session. In enterprise VPN environments where NetScaler Gateway is the entry point to the corporate network, this represents a significant data security and network security risk.

NetScaler is not a peripheral enterprise product — it sits at the perimeter of the network as the primary application delivery controller and VPN gateway for thousands of large organisations globally. A successful exploit of CVE-2026-3055 against a SAML IDP-configured NetScaler gives an attacker raw memory contents from the device that processes every SSO authentication across the enterprise. The digital security implications are significant — leaked memory can contain active session tokens allowing authentication bypass, cryptographic material enabling decryption of protected communications, and credential fragments from recently processed authentication requests. The internet security research firm watchTowr explicitly compared CVE-2026-3055 to Citrix Bleed and Citrix Bleed 2 — both of which were weaponised rapidly after disclosure and used by ransomware groups and nation-state actors to gain initial access to enterprise networks at scale. Citrix software has a documented exploitation history with four previous vulnerabilities — CVE-2023-4966, CVE-2025-5777, CVE-2025-6543, and CVE-2025-7775 — all having been exploited in the wild after disclosure. The combination of a critical CVSS score, a well-understood vulnerability class, a history of rapid exploitation, and the widespread deployment of NetScaler as enterprise network perimeter infrastructure makes this patch an emergency priority for every affected organisation.