CVE-2026-3055KEV · OVERDUECWE-125

Insufficient input validation leading to memory overread

Critical · published March 23, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.3. It is confirmed in active exploitation. It sits in the 90.6th percentile for exploit probability.

204
days past CISA
deadline
CVSS v4.0
9.3
EPSS
4%
Percentile
90.6
In the wild
Confirmed
What it is

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.04042 · 90.6th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-03-23T20:21Z
KEV added
2026-03-30 · due 2026-04-02
EPSS history
Timeline
  • 25 SEP 03:25Z
    EPSS moved 87% → 4%
    epss
  • 30 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 2
    kev
  • 23 MAR 20:21Z
    Insufficient input validation leading to memory overread
    cvelistv5