Security Assertion Markup Language

SAML 2.0 has been an OASIS standard since March 2005, the work of the consortium's Security Services technical committee. Organisations use SAML for single sign-on: an identity provider vouches for a user, and every service provider that trusts it accepts that assertion. A defect in an identity provider's SAML parser therefore reaches every application behind it.

In 2026 that exposure ran through Citrix NetScaler ADC. Of the six exploited NetScaler vulnerabilities CISA listed during the year, two came from its SAML code. CVE-2026-3055, nicknamed CitrixBleed 3 and disclosed on 23 March, is a memory overread affecting appliances set up as a SAML identity provider. CVE-2026-88779, listed on 4 October, is a memory overflow on appliances configured as either a SAML service provider or identity provider.

A third case, CVE-2026-8452, came from SAML signature canonicalisation. WatchTowr Labs showed that older NetScaler builds copy attacker-supplied data into a fixed-size buffer without a length check, and on 14 August published an exploit that runs code; Citrix had called it a denial-of-service bug on gateway and AAA servers. None of the three is a flaw in SAML itself.