Sessionwright

Known exploited

CVE-2026-3055: what NetScaler® admins need to do

CVE-2026-3055 (out-of-bounds read) affects NetScaler ADC and Gateway. In CISA KEV since 2026-03-30. Fixed in 14.1-66.59 / 13.1-62.23. Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2026-3055Request an emergency upgrade

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1-66.59 / 13.1-62.23First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2026-03-30, federal due date 2026-04-02. Known ransomware use: Unknown.
Forensic triage
No forensic triage flag on this KEV entry.
CVSS
9.3 (CVSS v4.0, vendor score in CTX696300)
Preconditions
Configured as SAML IdP (add authentication samlIdPProfile)
Session kill advised
No. The bulletin does not call for session termination. Community guidance recommends it (see After patching).

Fixed builds from the Citrix® security bulletin CTX696300

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.114.1-66.59Fixed in 14.1-60.58 or 14.1-66.59 and later14.1-73.46
NetScaler 13.1Past end of maintenance13.1-62.2313.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.262 FIPS13.1-37.283 FIPS

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler Out-of-Bounds Read Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler).

Our advisory data, taken from CTX696300, summarises it as: SAML IdP memory overread (leaks admin session IDs). Vulnerability class: out-of-bounds read (CWE-125). Precondition: Configured as SAML IdP (add authentication samlIdPProfile).

For the full description, read the CVE.org record for CVE-2026-3055 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as SAML IdP (add authentication samlIdPProfile). Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2026-3055 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2026-3055 highlighted

How to patch

  1. Choose the target build: at least 14.1-66.59 on 14.1 or 13.1-62.23 on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin

The bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.

Additional steps from CISA, CERTs and researchers

community guidance
kill aaa session -all
  • kill aaa session -all: Leak exposes admin session IDs
  • Rotate admin and API secrets

Run session kills only after every HA or cluster node is on the fixed build.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • SAML IdP memory overread probes

    • /saml/login with a SAMLRequest lacking AssertionConsumerServiceURL
    • /wsfed/passive?wctx with no value
    • Leaked data returned base64 in the NSC_TASS cookie

    Tools: watchTowr part 2 detection script

    Source: watchTowr; CrowdSec

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX696300 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date

Related CVEs

  • CVE-2026-4368Race condition causing user session mix-up (only 14.1-66.54)Not in KEVSame bulletin (CTX696300)
Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2026-3055: questions

Which NetScaler builds fix CVE-2026-3055?

Vendor bulletin CTX696300 fixes CVE-2026-3055 in 14.1-66.59 (NetScaler 14.1), 13.1-62.23 (NetScaler 13.1) and 13.1-37.262 FIPS (NetScaler 13.1 FIPS/NDcPP). As of 2026-10-15, the current safe builds, which also include later fixes, are 14.1-73.46, 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2026-3055 exploited in the wild?

Yes. CISA added CVE-2026-3055 to the Known Exploited Vulnerabilities catalog on 2026-03-30, with a federal remediation due date of 2026-04-02. Known ransomware campaign use: Unknown.

Do I need to kill sessions after patching CVE-2026-3055?

The bulletin does not call for session termination. Community guidance recommends kill aaa session -all after every node is upgraded; it is labelled as community guidance on this page.

Check every appliance, not just one, for CVE-2026-3055

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment