CVE-2026-3055

Overview

CVE-2026-3055 is a memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw is caused by insufficient input validation when the appliance is configured as a SAML Identity Provider (IDP), leading to an out-of-bounds read (CWE-125) that discloses sensitive process memory — including session tokens and authentication credentials — to unauthenticated remote attackers. This vulnerability has been compared to "CitrixBleed" due to its similar exploitation pattern and devastating impact.

Active Exploitation & "CitrixBleed 3" Comparisons

This CVE was added to CISA KEV on March 30, 2026 — one week after publication on March 23 — with an unusually aggressive 3-day remediation deadline of April 2, 2026. This extremely short deadline signals the severity and urgency that CISA attributes to active exploitation.

Why This Is So Dangerous

• Unauthenticated, remote exploitation: No credentials, no user interaction — just a single HTTP request can trigger memory disclosure.
• Session token theft: Leaked memory contains active administrative session IDs, enabling full appliance takeover.
• Multiple vulnerable endpoints: watchTowr Labs identified at least two distinct memory overread paths (/saml/login and /wsfed/passive?wctx) patched under this single CVE ID.
• Historical pattern: This follows the same exploitation pattern as the original CitrixBleed (CVE-2023-4966) and CitrixBleed 2 (CVE-2025-5777), making this effectively "CitrixBleed 3".
• Critical infrastructure exposure: NetScaler ADC and Gateway appliances sit at the network edge, providing VPN, load balancing, and authentication services for enterprise environments.

Vulnerability Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread.

The root cause is an out-of-bounds read (CWE-125) triggered when specific SAML/WS-Federation endpoints process requests with missing or malformed parameter values. When a query string parameter (such as wctx) is present but has no associated value, the application checks only for the parameter's presence rather than verifying that valid data exists. It then accesses a buffer that points to uninitialized or freed memory, causing kilobytes of process memory to be disclosed to the attacker — base64-encoded in response cookies.

The leaked memory is highly dynamic and can contain active session tokens, authentication credentials, HTTP request data from other users, and internal configuration details. An attacker can repeatedly send requests to harvest different memory regions, eventually obtaining administrative session IDs that grant full control of the appliance.

Affected Products & Versions

This vulnerability affects customer-managed NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected (Cloud Software Group applies updates to those automatically).

NetScaler ADC & NetScaler Gateway

Vulnerable Endpoints

How to Check if You're Vulnerable

Exploitation Details

Exploitation of this vulnerability is trivially simple. A single unauthenticated HTTP GET request is sufficient to trigger a memory disclosure:

Attack Flow

1. Attacker sends a crafted HTTP request to a vulnerable SAML/WS-Federation endpoint with a parameter present but missing its value.
2. The NetScaler appliance reads beyond the intended buffer boundary (out-of-bounds read).
3. Leaked process memory is returned to the attacker, base64-encoded in a response cookie (NSC_TASS).
4. The attacker repeats the request to harvest different memory regions, looking for session tokens and credentials.
5. Once an administrative session ID is captured, the attacker uses it to authenticate as an administrator — gaining full control of the appliance.

What Attackers Can Obtain

• Administrative session IDs — full appliance takeover
• User authentication tokens — impersonate legitimate users
• HTTP request data from other sessions — including headers and cookies
• Internal configuration details — network topology information
• Memory heap data — potentially containing credentials and sensitive configuration

Impact

Mitigation & Remediation

Patched Versions

Recommended Actions

1. Upgrade immediately to one of the patched firmware versions listed above.
2. Rotate all session tokens and credentials after patching — leaked sessions may still be active.
3. Review access logs for suspicious requests to /saml/login and /wsfed/passive endpoints, particularly requests with parameters missing values.
4. If patching is not immediately possible: consider temporarily disabling the SAML IDP configuration if operationally feasible, or restrict network access to the SAML endpoints.
5. Monitor CISA KEV Catalog for any updated guidance.

Post-Patch Verification