CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler "CitrixBleed 3" Memory Overread

Key Points

• CVE-2026-3055 is a critical (CVSS v4.0 9.3) unauthenticated memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers.
• Attackers send malformed requests to /saml/login (omitting AssertionConsumerServiceURL) or to /wsfed/passive?wctx (with a valueless wctx parameter) and read kilobytes of leftover process memory — including session tokens, SAML assertions, and LDAP credentials — base64-encoded in the NSC_TASSresponse cookie.
• A companion bug, CVE-2026-4368 (CVSS 7.7), is a race condition that mixes user sessions on Gateway/AAA Vservers and affects only build 14.1-66.54.
• CISA added CVE-2026-3055 to the KEV catalog on 30 March 2026 with a federal patch deadline of 2 April 2026.
• Active exploitation is confirmed.
• Patch to 14.1-66.59, 13.1-62.23, or 13.1-FIPS/NDcPP 13.1-37.262 now.

At-a-Glance Vulnerability Facts

Why This Matters: The Third Chapter in the "CitrixBleed" Saga

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway sit at the edge of almost every large enterprise network on the planet;

• load-balancing applications,
• terminating SSL,
• brokering SAML assertions, and
• acting as the front door for remote access.

That positioning is exactly why the product line keeps appearing on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Before CVE-2026-3055, defenders had already lived through:

• CVE-2023-4966 — "CitrixBleed" — memory disclosure via session tokens, used by LockBit affiliates against Boeing, ICBC, DP World, and others.
• CVE-2025-5777 — "CitrixBleed 2" — out-of-bounds read in a similar authentication path.
• CVE-2025-6543 and CVE-2025-7775 — additional NetScaler bugs that saw in-the-wild exploitation during 2025.

CVE-2026-3055 (nicknamed "CitrixBleed 3" across the security community) repeats the pattern with a new twist: the bug lives in the SAML Identity Provider (IdP) path, and, as later discovered, the single CVE ID actually covers at least two distinct memory-overread primitives affecting two different endpoints.

That matters because organizations that ruled themselves out after skimming the advisory (thinking "we don't run an IdP") should re-read this post carefully.

Technical Deep Dive: How CVE-2026-3055 Actually Works

The Protocol Context

When NetScaler is configured as a SAML IdP (indicated in config by add authentication samlIdPProfile), it accepts browser-initiated authentication requests on two federation endpoints:

• /saml/login — SAML 2.0 Web Browser SSO profile
• /wsfed/passive — WS-Federation passive requestor profile

Both endpoints parse user-controlled parameters before the user is authenticated. That is the key design fact that makes the vulnerability reachable by any unauthenticated attacker on the internet.

Primitive #1 — Malformed SAMLRequest to /saml/login

The first exploitation primitive, documented by watchTowr and corroborated by Defused Cyber's honeypot telemetry, works like this:

• The attacker crafts an HTTP POST (or GET redirect-binding) to /saml/login containing a base64-encoded SAMLRequest XML.
• The crafted <samlp:AuthnRequest> omits the AssertionConsumerServiceURL attribute.
• On a patched appliance, NetScaler rejects the request cleanly: "Parsing of presented Assertion failed; Please contact your administrator."
• On a vulnerable appliance, NetScaler's parser follows a code path where it expects AssertionConsumerServiceURL to be populated, but the field is never validated before use. The parser reads past the end of the intended buffer and incorporates residual heap bytes into its response.
• Those bytes are emitted — base64-encoded — inside the NSC_TASS response cookie.

The leaked memory is not random noise.

Because heap reuse on NetScaler tends to recycle buffers allocated during prior authentication flows, the NSC_TASS value on a busy appliance can carry plaintext SAML assertions, session cookies issued to other users, LDAP bind credentials, and internal IP addresses from recently processed requests.

Primitive #2 — The wctx Query-String Trick on /wsfed/passive

Later analysis revealed a second, arguably more dangerous primitive sharing the same CVE identifier:

1. Send a request to /wsfed/passive?wctx (note: no = sign and no value after wctx).
2. The NetScaler parser checks only for the presence of the wctx parameter name — not for the presence of associated data.
3. The code then reads from the buffer that would have held wctx's value. Because the value was never assigned, the buffer points to dead memory.
4. Again, the leaked bytes are returned base64-encoded in the NSC_TASS cookie — but this variant leaks kilobytes of memory per request, reliably, with none of the input-size constraints of the first primitive.

The amount of disclosed memory is more than enough to scrape valid session cookies and replay them for full Gateway access without ever knowing a password.

Why NSC_TASS?

NSC_TASS is NetScaler's internal "Token Authorization Service" cookie.

It is normally used for short-lived cross-request state during an authentication flow. The bug reuses that cookie as the data exfiltration channel, but the content placed in it is drawn from memory the attacker should never have been able to reach.

That is the textbook shape of a CWE-125 out-of-bounds read.

Attacker Workflow (End-to-End)

Figure 1. Four-stage CVE-2026-3055 attack chain: recon on /cgi/GetAuthMethods, exploit via /saml/login or /wsfed/passive?wctx, NSC_TASS memory leak, session hijack.

CVE-2026-4368 — The Quieter Sibling

CVE-2026-4368 is a race condition (CWE-362) that affects a much narrower population — only appliances running the specific build 14.1-66.54, configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.

Under contention, the session state for one authenticated user can be swapped with another, effectively giving attacker A access to victim B's session.

The attack vector complexity (AT:P in the CVSS string) reflects that it requires winning a timing window, but the impact, full hijack of another user's authenticated context, is why the score still reaches 7.7.

Because the window of affected builds is so narrow (one build), many organizations can resolve CVE-2026-4368 simply by moving to 14.1-66.59.

Am I Vulnerable? Authoritative Self-Assessment

Step 1 — Identify Affected Versions

Run the following from the NetScaler CLI:

You are in scope if the reported build is below:

• 14.1: 14.1-66.59
• 13.1: 13.1-62.23
• 13.1-FIPS / 13.1-NDcPP: 13.1-37.262

(Note: Citrix's advisory also lists 14.1-60.58 as a version that remediates both CVEs for organizations on that release train.)

Step 2 — Confirm the SAML IdP Precondition (CVE-2026-3055)

From the NetScaler CLI — SSH into the appliance and run:

If this command returns any output (other than "No entries found"), your appliance is configured as a SAML IdP and is in scope for CVE-2026-3055.

Step 3 — Confirm the Gateway / AAA Preconditions (CVE-2026-4368)

Any hits to add authentication vserver (AAA vserver) or add vpn vserver (Gateway) on build 14.1-66.54 specifically means you are in scope for CVE-2026-4368.

Step 4 — Check Internet Exposure

For each SAML IdP instance identified, validate whether it is reachable from the public internet by confirming that its SNIP/VIP is routed externally and that /saml/login and /wsfed/passive respond on 443.

Internet-facing IdPs are the highest remediation priority.

Detection: IOCs, Network Signatures, and Hunt Queries

Because exploitation produces distinctive HTTP patterns, detection is tractable even without an up-to-date NetScaler patch.

Defenders should hunt across WAF logs, NetScaler ns.log / syslog, and any reverse-proxy access logs in front of the appliance.

Network-Level Indicators

• Auth-method fingerprinting (reconnaissance):
• GET /cgi/GetAuthMethods from external IPs, particularly in bursts or from infrastructure with no prior history.
• Primitive #1 — SAML login abuse:
• POST /saml/login where the decoded SAMLRequest lacks an AssertionConsumerServiceURL attribute on <samlp:AuthnRequest>.
• Primitive #2 — wctx trick:
• Requests whose URI matches the regex ^/wsfed/passive\?wctx(?!=) — that is, wctx is present but has no = and no value.
• Exfiltration signal:
• Set-Cookie: NSC_TASS= response headers that are anomalously large (hundreds of bytes or more), or whose decoded base64 payload contains printable ASCII (SAML XML, session-cookie substrings, LDAP DNs).

Post-Compromise Forensics

Because the bug leaks memory that may have contained previously issued session cookies, patching alone is not sufficient.

Treat any unpatched internet-facing SAML IdP as potentially compromised and:

1. Rotate session material — invalidate all NSC_AAAC, NSC_TMAS, and NSC_TASS cookies; force re-authentication for all users.
2. Rotate secrets touched by the identity path — LDAP bind credentials, SAML signing keys, service-account passwords.
3. Hunt for downstream movement — from the NetScaler, look for anomalous VPN logins, ICA Proxy session creation outside business hours, or RDP Proxy sessions initiated from unfamiliar source IPs.
4. Preserve NetScaler logs before upgrade — the upgrade path can rotate ns.log and lose evidence.

Remediation Playbook

Priority 1 — Patch (within 24–48 hours for internet-facing IdPs):

Upgrade to one of the fixed builds:

• NetScaler ADC & Gateway 14.1-66.59 or later (recommended for 14.1 fleets)
• NetScaler ADC & Gateway 14.1-60.58 (also listed by Citrix as remediated)
• NetScaler ADC & Gateway 13.1-62.23 or later
• NetScaler ADC 13.1-FIPS / 13.1-NDcPP 13.1-37.262 or later

Priority 2 — Assume breach on unpatched systems if the appliance was internet-facing as a SAML IdP at any point after 23 March 2026. Invalidate sessions, rotate credentials, and open an incident ticket.

Priority 3 — Reduce attack surface:

• Where operationally feasible, remove the SAML IdP role from internet-facing NetScaler instances and delegate IdP duties to a purpose-built identity platform (Entra ID, Okta, Ping, Keycloak).
• Place NetScaler management planes behind jump hosts; never expose NSIP/management VIPs to the public internet.
• Front the Gateway with WAF rules that drop /wsfed/passive?wctx requests lacking a = and alert on SAMLRequestpayloads missing AssertionConsumerServiceURL.

Priority 4 — Structural response:

NetScaler has now produced four high-severity memory-disclosure bugs on its identity edge in roughly thirty months. Organizations should evaluate, at a governance level, whether a network-appliance vendor is the appropriate home for federation identity duties, and whether concentration risk on a single vendor at both the network edge and the authentication broker should be reduced.

How Picus Helps Simulate CVE-2026-3055 CitrixBleed 3 Vulnerability Exploitation Attacks?

We also strongly suggest simulating the CVE-2026-3055 ("CitrixBleed 3") vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Security Validation Platform.

You can also test your defenses against other edge-appliance exploitation attacks, such as the original Citrix Bleed (CVE-2023-4966), Citrix Bleed 2 (CVE-2025-5777), CVE-2025-6543, and CVE-2025-7775, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for CVE-2026-3055 exploitation attacks:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Security Validation Platform.