KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2026-3055
9.8
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityCitrix NetScaler Out-of-Bounds Read Vulnerability
VendorCitrix
ProductNetScaler
Date added2026-03-30
Due date2026-04-02
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-125
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions
KEV: Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
NVD: Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-08-28 02:48 UTC
Wall time45.0s
Searches5
Component defaultno
Sources
https://support.citrix.com/external/article/CTX696300
https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread
https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/
https://censys.com/advisory/cve-2026-3055/
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-3055/
https://nvd.nist.gov/vuln/detail/CVE-2026-3055
https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread
https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/
https://censys.com/advisory/cve-2026-3055/
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-3055/
https://nvd.nist.gov/vuln/detail/CVE-2026-3055
QC notes
warn component_extraction: Component 'NetScaler ADC/Gateway SAML Identity Provider (IdP) assertion consumer service — specifically the handlers for /saml/login and /wsfed/passive endpoints in the appliance's SAML assertion parser' matches or contains product name 'NetScaler' — no specific component identified
Hunting hypothesis agent
Look for GET /wsfed/passive?wctx without an equals sign or /saml/login with SAMLRequest missing AssertionConsumerServiceURL; a vulnerable NetScaler leaks heap memory as a base64 NSC_TASS cookie containing session IDs and HTTP headers.
Research details
ComponentNetScaler ADC/Gateway SAML Identity Provider (IdP) assertion consumer service — specifically the handlers for /saml/login and /wsfed/passive endpoints in the appliance's SAML assertion parser
PreconditionsTarget must be a customer-managed NetScaler ADC or NetScaler Gateway appliance (not Citrix-managed cloud instances). The appliance must be configured as a SAML Identity Provider (SAML IdP), verifiable by the presence of 'add authentication samlIdPProfile' in the configuration. Appliance must be running a vulnerable version: NetScaler ADC/Gateway 14.1 before 14.1-60.58 (or 14.1-66.59), 13.1 before 13.1-62.23, or 13.1-FIPS/NDcPP before 13.1-37.262. The /saml/login or /wsfed/passive endpoints must be network-reachable on port 443. agent
DeliveryAttackers send crafted HTTP requests to the /saml/login endpoint containing a base64-encoded SAMLRequest that omits the AssertionConsumerServiceURL attribute, or to /wsfed/passive with a valueless wctx parameter (no '=' sign). The appliance's SAML parser fails to validate input bounds, causing out-of-bounds memory reads. Leaked memory is base64-encoded and returned in the NSC_TASS response cookie, which can contain session tokens, credentials, and other sensitive data from adjacent heap memory.
Public PoCyes
PoC URLs
https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
https://github.com/RootAid/CVE-2026-3055 Third-party repos; verify before use.
https://github.com/RootAid/CVE-2026-3055 Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Multiple exploit primitives exist: (1) malformed SAMLRequest to /saml/login omitting AssertionConsumerServiceURL, (2) valueless wctx parameter to /wsfed/passive. No authentication required. Exploitation is straightforward with publicly available PoC scripts and Metasploit module.
SummaryCVE-2026-3055 is a critical out-of-bounds read vulnerability in customer-managed Citrix NetScaler ADC and Gateway appliances configured as a SAML Identity Provider (IdP). An unauthenticated remote attacker can trigger memory disclosure via crafted SAML requests to /saml/login or /wsfed/passive endpoints, leaking sensitive data including session tokens, SAML assertions, and LDAP credentials through the NSC_TASS response cookie, enabling full session hijacking. Active exploitation was confirmed by March 27, 2026, leading to CISA KEV inclusion on March 30, 2026, with the vulnerability nicknamed 'CitrixBleed 3' across the security community.
Tia coverage
First reported2026-08-01
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
unit-42-hacker-uses-deepseek-open-source-ai-agent-for-fully-auto
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.