**Critical Flaw Exposed in Citrix NetScaler: Update Now to Prevent Data Leaks**

A critical flaw has been discovered in Citrix NetScaler, a popular application delivery controller (ADC) used by many organizations worldwide. The vulnerability, tracked as CVE-2026-3055, could allow unauthenticated attackers to leak sensitive data from the appliance's memory. Citrix has released security updates to fix the issue, and users are urged to apply them immediately.

The critical flaw, an out-of-bounds read vulnerability with a CVSS score of 9.3, was discovered internally by Citrix and is currently not being exploited in the wild. However, once exploit code becomes available, attacks are likely to follow suit. This scenario is reminiscent of "CitrixBleed" (CVE-2023-4966), another memory-leak flaw that saw widespread exploitation last year.

**What's Vulnerable and Why**

The vulnerability, CVE-2026-3055, affects Citrix ADC and Citrix Gateway when configured as a SAML Identity Provider (SAML IDP). To check if your NetScaler appliance is set up in this configuration, look for the string "This" in the system settings. The Rapid7 research team has provided more information on the vulnerability, including a detailed advisory.

**Consequences of Exploitation**

If exploited, CVE-2026-3055 could allow attackers to access sensitive data stored in the appliance's memory. This could include confidential information such as login credentials, customer data, or even encryption keys. The consequences of a successful exploit would be severe, and it is essential that users take immediate action to mitigate this risk.

**Citrix NetScaler Vulnerability - CVE-2026-3055 Details**

* **Vulnerability Type:** Out-of-bounds read * **CVSS Score:** 9.3 * **Impact:** Sensitive data leak from appliance's memory * **Configuration Required:** Citrix ADC or Citrix Gateway configured as a SAML IDP

**The Second Vulnerity: CVE-2026-4368**

In addition to the critical flaw, Citrix has also addressed another vulnerability, tracked as CVE-2026-4368. This is a race condition with a CVSS score of 7.7 that causes session mix-ups.

**What You Can Do to Protect Yourself**

To prevent data leaks and exploitation of this critical flaw:

1. **Apply the security updates**: Citrix has released patches for both vulnerabilities, and it's essential to update your NetScaler appliance as soon as possible. 2. **Verify SAML IDP configuration**: Check if your NetScaler appliance is configured as a SAML Identity Provider (SAML IDP) and take necessary measures to secure this configuration. 3. **Monitor your systems**: Regularly monitor your system logs for any suspicious activity, and be prepared to respond quickly in case of an exploit.

**Conclusion**

The discovery of the critical flaw in Citrix NetScaler highlights the importance of regular security updates and monitoring. It's essential that users take immediate action to patch their systems and prevent data leaks. Remember, similar vulnerabilities like "CitrixBleed" (CVE-2023-4966) have seen widespread exploitation in the past, making it crucial to act now.

Stay informed about the latest cybersecurity news and threats by following us on Twitter: @securityaffairs and Facebook and Mastodon.