Out-of-Bounds Read Vulnerability (CVE‑2026‑3055) in Citrix NetScaler SAML IdP Configuration
What It Is – A newly disclosed out‑of‑bounds read (memory over‑read) affects Citrix NetScaler ADC, NetScaler Gateway and related FIPS/NDcPP builds when the appliance is configured as a SAML Identity Provider (IdP).
Exploitability – The flaw can be triggered by a crafted SAML request; a public proof‑of‑concept has not been released, but the CVSS score assigned by NVD is 7.5 (High), indicating a realistic path to data disclosure.
Affected Products – Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway), NetScaler ADC FIPS, and NetScaler ADC NDcPP.
Why It Matters for Trust & Control Assurance
- Control Mapping – The issue tests the “Secure Configuration Management” control area, which maps to dozens of framework objectives (e.g., NIST CSF Identify ID.BE‑5, ISO 27001 A.12.1). Demonstrating that this control is continuously monitored and evidence is collected satisfies multiple compliance regimes at once.
- Audit Evidence – A breach stemming from mis‑configured SAML IdP would leave a trace in authentication logs. Maintaining immutable log records and correlating them with configuration baselines provides defensible audit evidence.
- Enterprise Buyer Expectation – Large buyers now request proof that critical network‑edge devices are hardened and that any deviation is flagged in real time. Continuous control‑mapping dashboards give that assurance.
Recommended Actions
- Apply the Citrix‑released patch for CVE‑2026‑3055 immediately.
- Review all NetScaler instances acting as SAML IdPs; disable unnecessary SAML endpoints.
- Enable detailed SAML request/response logging and integrate logs into a SIEM for continuous monitoring.
- Map the “Secure Configuration Management” control to your framework of record and capture remediation evidence in a Trust Center repository.
Source: CISA KEV – CVE‑2026‑3055