External risk intelligence
NetScaler ADC and Gateway could allow external attackers to expose sensitive information.
NetScaler ADC and Gateway appliances configured as SAML identity providers could allow external attackers to access system memory, potentially exposing authentication credentials and sensitive data. This vulnerability is currently being actively exploited in the wild, posing a high risk to your operations.
CVE-2026-3055
Exposure facts
H – Horizon Alert
A security vulnerability exists in NetScaler ADC and NetScaler Gateway when these systems are configured to act as an authentication provider (SAML IDP). The issue stems from insufficient validation of incoming data, which can inadvertently allow unauthorized access to the device's memory. This is a business concern because it could potentially enable the exposure of sensitive information stored within the system, impacting the confidentiality of that data.
A – Asset Exposure
This vulnerability impacts NetScaler ADC and NetScaler Gateway appliances when they are configured as a SAML Identity Provider. Because these devices are commonly deployed at the network edge to manage authentication for remote access, they are frequently reachable from the public internet. This exposure could potentially allow external attackers to access sensitive memory contents, which may contain authentication credentials or other private data processed during user login workflows.
L – Live Threat
This vulnerability is actively being exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Public research and technical analysis regarding this issue are also available, which increases the likelihood of successful targeting. Consequently, the current risk signals indicate a high potential for exploitation of the affected systems.
O – Operational Fix
To address this vulnerability, please have your team identify any NetScaler ADC or Gateway instances configured as a SAML Identity Provider (IDP). Prioritize applying the required mitigations as outlined in the official vendor support documentation. If your team cannot apply the recommended mitigations immediately, consider restricting or disabling the SAML IDP configuration until the necessary updates are in place. Ensure your security operations team validates these actions to maintain the integrity of your network environment.