CVE intelligenceCISA KEV

CVE-2026-3055

Citrix NetScaler Out-of-Bounds Read Vulnerability

Published Mar 23, 2026Sources checked Sep 12, 2026

9.8CRITICALCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-3055 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Citrix NetScaler.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA KEVListedObserved exploitation

EPSS87.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-3055?

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread