MSRXMSRXSecurity
Vulnerabilities / CVE-2026-3055

CVE-2026-3055

Published 2026-03-23 · published (not yet in NVD)

CVE-2026-3055

Insufficient input validation leading to memory overread

Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-30, with a fix-by date of 2026-04-02. Patch it first.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

9.3 CRITICAL
CVSS 4.0 · CNA
91%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Scores

9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:LCNA

Affected products

  • NetScaler ADC: 14.1 to < 66.59; 13.1 to < 62.23; 13.1 FIPS and NDcPP to < 37.262
  • NetScaler Gateway: 14.1 to < 66.59; 13.1 to < 62.23

Weakness: CWE-125

1 references (advisories, patches, write-ups)

Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVECheck your dependenciesScan a website