CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Unauthenticated Memory Disclosure and Session Hijacking

CVE-2026-3055 & CVE-2026-4368 (TL-2026-0277), also tracked as NetScaler Memory Disclosure 2026, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-03-24. It has no confirmed attribution, affects Citrix / Cloud Software Group NetScaler ADC, references 2 CVEs (CVE-2026-3055, CVE-2026-4368), maps to 14 MITRE ATT&CK techniques (T1005, T1041, T1068), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0277

Threat ID
TL-2026-0277
Also known as
NetScaler Memory Disclosure 2026, CitrixBleed 3
Severity
CRITICAL
CVSS
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-03-24
Last reviewed
2026-03-24
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, education, technology, critical-infrastructure, legal, manufacturing, defense, telecommunications
Target regions
North America, Europe, Asia Pacific, Middle East, Global
Detection rules
9
Indicators of compromise
18

Critical out-of-bounds read vulnerability (CVE-2026-3055, CVSS 9.3) in Citrix NetScaler ADC and Gateway enables unauthenticated remote attackers to leak sensitive memory contents from SAML IDP-configured appliances. A companion race condition (CVE-2026-4368, CVSS 7.7) allows authenticated session hijacking on Gateway/AAA virtual servers. Patches released March 23, 2026. No exploitation observed yet but imminent exploitation is highly likely given 56,000+ internet-exposed NetScaler instances and historical precedent with CitrixBleed.

How CVE-2026-3055 & CVE-2026-4368 works

Citrix (Cloud Software Group) disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway on March 23, 2026, via security bulletin CTX696300.

CVE-2026-3055 — Unauthenticated Memory Disclosure (CVSS 4.0: 9.3 Critical)

CVE-2026-3055 is an out-of-bounds read vulnerability caused by insufficient input validation in the SAML Identity Provider (IDP) authentication module of NetScaler ADC and Gateway. When an appliance is configured as a SAML IDP — a common enterprise configuration for single sign-on (SSO) — an unauthenticated remote attacker can craft malicious requests that trigger a memory overread condition. This allows the attacker to leak potentially sensitive data from the appliance's memory, which may include authentication tokens, session cookies, certificates, private keys, and other credentials stored in adjacent memory regions.

The vulnerability is classified as CWE-125 (Out-of-Bounds Read). The attack requires no authentication and has low complexity, making it highly exploitable once a proof-of-concept emerges. Organizations can determine if they are affected by searching their NetScaler configuration for the string "add authentication samlIdPProfile" — the presence of this configuration indicates SAML IDP is enabled and the appliance is potentially vulnerable.

CVE-2026-4368 — Authenticated Session Hijacking via Race Condition (CVSS 4.0: 7.7 High)

CVE-2026-4368 is a race condition vulnerability (CWE-362) affecting appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The race condition causes a user session mixup, enabling an authenticated low-privilege attacker to hijack another user's session by exploiting a timing window in session handling. This leads to full compromise of the victim's session confidentiality and integrity, potentially allowing the attacker to access sensitive resources, execute administrative actions, or exfiltrate data under the victim's identity.

Historical Context and Urgency

These vulnerabilities carry significant urgency due to NetScaler's history of critical exploitation. CVE-2023-4966 (CitrixBleed) was a similar memory leak vulnerability that was massively exploited in the wild by ransomware groups including LockBit, leading to widespread compromise. CVE-2025-5777 (CitrixBleed 2) further demonstrated that NetScaler memory disclosure bugs are prime targets for threat actors. With over 56,000 NetScaler services currently discoverable on Shodan and a large-scale reconnaissance campaign targeting Citrix Gateway infrastructure detected between January 28 and February 2, 2026 (over 111,834 sessions from 63,000+ unique IPs per GreyNoise), the attack surface is massive. Security researcher Benjamin Harris of Rapid7 stated that "imminent exploitation is highly likely" given NetScalers' critical role in enterprise perimeter access.

Cloud-managed NetScaler instances are not affected — only customer-managed on-premises deployments require patching. NetScaler ADC 12.1 has reached end of life and is no longer supported; organizations running 12.1 must upgrade to a supported version.

MITRE ATT&CK techniques used in TL-2026-0277

collection

T1005 Data from Local System

exfiltration

T1041 Exfiltration Over C2 Channel

privilege-escalation

T1068 Exploitation for Privilege Escalation

discovery

T1082 System Information Discovery

initial-access

T1190 Exploit Public-Facing Application

defense-evasion

T1211 Exploitation for Stealth; T1550 Use Alternate Authentication Material

credential-access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

impact

T1531 Account Access Removal

resource-development

T1588 Obtain Capabilities

reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in CVE-2026-3055 & CVE-2026-4368

  • Citrix / Cloud Software Group — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-66.59; 13.1 before 13.1-62.23
    Fixed in: 14.1-66.59; 13.1-62.23
  • Citrix / Cloud Software Group — NetScaler ADC 13.1-FIPS
    Vulnerable versions: 13.1-FIPS before 13.1-37.262
    Fixed in: 13.1-37.262
  • Citrix / Cloud Software Group — NetScaler ADC 13.1-NDcPP
    Vulnerable versions: 13.1-NDcPP before 13.1-37.262
    Fixed in: 13.1-37.262
  • Citrix / Cloud Software Group — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-66.59; 13.1 before 13.1-62.23
    Fixed in: 14.1-66.59; 13.1-62.23

Remediation for CVE-2026-3055 & CVE-2026-4368

Patches

  • NetScaler ADC and Gateway 14.1-66.59 (fixes both CVEs)
  • NetScaler ADC and Gateway 13.1-62.23 (fixes both CVEs)
  • NetScaler ADC 13.1-FIPS 13.1-37.262 (fixes both CVEs)
  • NetScaler ADC 13.1-NDcPP 13.1-37.262 (fixes both CVEs)

Immediate actions

  • Apply Citrix patches immediately: upgrade to NetScaler ADC/Gateway 14.1-66.59 or 13.1-62.23
  • Upgrade NetScaler ADC 13.1-FIPS and 13.1-NDcPP to 13.1-37.262 or later
  • Verify SAML IDP configuration: run 'show authentication samlIdPProfile' to identify vulnerable appliances
  • Monitor NetScaler logs for anomalous SAML authentication requests and memory-related errors
  • Review active sessions for signs of session hijacking or unauthorized access
  • Block suspicious source IPs performing bulk SAML authentication requests at the perimeter

Workarounds

  • No official workarounds provided by Citrix — patching is the only remediation
  • If patching is not immediately possible, consider temporarily disabling SAML IDP configuration to mitigate CVE-2026-3055
  • For CVE-2026-4368, restrict access to Gateway and AAA virtual servers to trusted IP ranges
  • Monitor for exploitation indicators: anomalous memory usage, unexpected SAML assertion sizes, session irregularities

Longer-term hardening

  • Migrate from NetScaler ADC 12.1 (EOL) to supported version immediately
  • Implement Web Application Firewall (WAF) rules to inspect and filter malicious SAML requests
  • Deploy network segmentation to limit lateral movement from compromised edge appliances
  • Enable enhanced logging on all NetScaler appliances for forensic readiness
  • Establish emergency patching SLA for internet-facing edge devices (24-48 hours for CRITICAL)
  • Consider migrating to cloud-managed NetScaler instances which are not affected
  • Implement session binding and anti-replay mechanisms to mitigate session hijacking risks

CVEs associated with CVE-2026-3055 & CVE-2026-4368

CVE-2026-3055, CVE-2026-4368

Weaknesses (CWE) in CVE-2026-3055 & CVE-2026-4368

CWE-125, CWE-362

Timeline of CVE-2026-3055 & CVE-2026-4368

  • CVE-2023-4966 (CitrixBleed) disclosed — critical memory disclosure in NetScaler that was massively exploited by LockBit and other ransomware groups, establishing historical precedent for this vulnerability class
  • CVE-2025-5777 (CitrixBleed 2) disclosed — another memory disclosure in NetScaler Gateway, further demonstrating this attack surface remains actively targeted
  • Large-scale reconnaissance campaign targeting Citrix ADC Gateway and NetScaler Gateway infrastructure begins, detected by GreyNoise Global Observation Grid with over 111,834 sessions from 63,000+ unique IPs through February 2, 2026
  • GreyNoise-detected Citrix Gateway reconnaissance campaign concludes, having achieved 79% targeting rate against Citrix Gateway honeypots — indicating systematic pre-positioning
  • Rapid7 publishes Emerging Threat Report; Benjamin Harris states 'imminent exploitation is highly likely'. Arctic Wolf and CERT-EU publish independent analyses. NHS England issues Cyber Alert CC-4759
  • Fixed versions released: NetScaler ADC/Gateway 14.1-66.59, 13.1-62.23, and 13.1-FIPS/NDcPP 13.1-37.262
  • Citrix (Cloud Software Group) publishes security bulletin CTX696300 disclosing CVE-2026-3055 (CVSS 9.3) and CVE-2026-4368 (CVSS 7.7) with patches for all supported NetScaler ADC and Gateway versions
  • Threadlinqs Intelligence begins active monitoring for exploitation indicators, PoC emergence, and threat actor targeting of CVE-2026-3055
  • SOCRadar, The Hacker News, CybersecurityNews, Heise Online, and GBHackers publish analyses. No public PoC or exploitation observed as of this date. Over 56,000 NetScaler services visible on Shodan
  • As of 2026-05-29, CVE-2026-3055 ("CitrixBleed 3") is under confirmed active exploitation: CISA added it to KEV on 2026-03-30 (FCEB deadline 04-02), with CrowdSec/watchTowr/Defused Cyber tracing live attacks from 03-27 against unpatched, internet-exposed NetScaler SAML IDP gateways. The record's stale "PATCHED/no exploitation" status is wrong; patches exist but mass exploitation of 56k+ exposed instances continues, mirroring the CitrixBleed-LockBit ransomware pattern.

Sources cited for CVE-2026-3055 & CVE-2026-4368

Threats related to CVE-2026-3055 & CVE-2026-4368

Detection coverage for TL-2026-0277

As of 2026-03-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0277 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats