# CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Unauthenticated Memory Disclosure and Session Hijacking

> Critical out-of-bounds read vulnerability (CVE-2026-3055, CVSS 9.3) in Citrix NetScaler ADC and Gateway enables unauthenticated remote attackers to leak sensitive memory contents from SAML IDP-configured appliances. A companion race condition (CVE-2026-4368, CVSS 7.7) allows authenticated session hijacking on Gateway/AAA virtual servers. Patches released March 23, 2026. No exploitation observed yet but imminent exploitation is highly likely given 56,000+ internet-exposed NetScaler instances and historical precedent with CitrixBleed.

- **Published:** 2026-03-24T12:00:00Z
- **Last reviewed:** 2026-03-24T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0277
- **ID:** TL-2026-0277
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3055, CVE-2026-4368

## Description

Citrix (Cloud Software Group) disclosed two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway on March 23, 2026, via security bulletin CTX696300.

CVE-2026-3055 — Unauthenticated Memory Disclosure (CVSS 4.0: 9.3 Critical)

CVE-2026-3055 is an out-of-bounds read vulnerability caused by insufficient input validation in the SAML Identity Provider (IDP) authentication module of NetScaler ADC and Gateway. When an appliance is configured as a SAML IDP — a common enterprise configuration for single sign-on (SSO) — an unauthenticated remote attacker can craft malicious requests that trigger a memory overread condition. This allows the attacker to leak potentially sensitive data from the appliance's memory, which may include authentication tokens, session cookies, certificates, private keys, and other credentials stored in adjacent memory regions.

The vulnerability is classified as CWE-125 (Out-of-Bounds Read). The attack requires no authentication and has low complexity, making it highly exploitable once a proof-of-concept emerges. Organizations can determine if they are affected by searching their NetScaler configuration for the string "add authentication samlIdPProfile" — the presence of this configuration indicates SAML IDP is enabled and the appliance is potentially vulnerable.

CVE-2026-4368 — Authenticated Session Hijacking via Race Condition (CVSS 4.0: 7.7 High)

CVE-2026-4368 is a race condition vulnerability (CWE-362) affecting appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The race condition causes a user session mixup, enabling an authenticated low-privilege attacker to hijack another user's session by exploiting a timing window in session handling. This leads to full compromise of the victim's session confidentiality and integrity, potentially allowing the attacker to access sensitive resources, execute administrative actions, or exfiltrate data under the victim's identity.

Historical Context and Urgency

These vulnerabilities carry significant urgency due to NetScaler's history of critical exploitation. CVE-2023-4966 (CitrixBleed) was a similar memory leak vulnerability that was massively exploited in the wild by ransomware groups including LockBit, leading to widespread compromise. CVE-2025-5777 (CitrixBleed 2) further demonstrated that NetScaler memory disclosure bugs are prime targets for threat actors. With over 56,000 NetScaler services currently discoverable on Shodan and a large-scale reconnaissance campaign targeting Citrix Gateway infrastructure detected between January 28 and February 2, 2026 (over 111,834 sessions from 63,000+ unique IPs per GreyNoise), the attack surface is massive. Security researcher Benjamin Harris of Rapid7 stated that "imminent exploitation is highly likely" given NetScalers' critical role in enterprise perimeter access.

Cloud-managed NetScaler instances are not affected — only customer-managed on-premises deployments require patching. NetScaler ADC 12.1 has reached end of life and is no longer supported; organizations running 12.1 must upgrade to a supported version.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1068 Exploitation for Privilege Escalation
- T1550 Use Alternate Authentication Material
- T1211 Exploitation for Stealth
- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1082 System Information Discovery
- T1531 Account Access Removal
- T1041 Exfiltration Over C2 Channel

## Sources

- [Citrix Security Bulletin CTX696300](https://support.citrix.com/external/article/CTX696300/netscaler-adc-and-netscaler-gateway-secu.html)
- [Rapid7 ETR: CVE-2026-3055 NetScaler Out-of-Bounds Read](https://www.rapid7.com/blog/post/etr-cve-2026-3055-citrix-netscaler-adc-and-netscaler-gateway-out-of-bounds-read/)
- [Arctic Wolf: CVE-2026-3055 Analysis](https://arcticwolf.com/resources/blog/cve-2026-3055/)
- [CERT-EU Advisory 2026-003: Multiple Vulnerabilities in Citrix NetScaler](https://cert.europa.eu/publications/security-advisories/2026-003/)
- [The Hacker News: Citrix Urges Patching Critical NetScaler Flaw](https://thehackernews.com/2026/03/citrix-urges-patching-critical.html)
- [SOCRadar: CVE-2026-3055 NetScaler Memory Disclosure](https://socradar.io/blog/cve-2026-3055-netscaler-memory-disclosure/)
- [CybersecurityNews: Critical NetScaler ADC and Gateway Vulnerabilities](https://cybersecuritynews.com/netscaler-adc-and-gateway-vulnerabilities/)
- [Heise Online: Critical Security Vulnerability in Citrix Gateway and Netscaler ADC](https://www.heise.de/en/news/Critical-security-vulnerability-in-Citrix-Gateway-and-Netscaler-ADC-11221853.html)
- [GBHackers: Critical NetScaler ADC and Gateway Flaws](https://gbhackers.com/critical-netscaler-adc-and-gateway-flaws/)
- [NHS England Cyber Alert CC-4759](https://digital.nhs.uk/cyber-alerts/2026/cc-4759)
- [Kraft Kennedy: NetScaler Security Bulletin for CVE-2026-3055 and CVE-2026-4368](https://www.kraftkennedy.com/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-3055-and-cve-2026-4368/)
- [THREATINT: CVE-2026-3055](https://cve.threatint.eu/CVE/CVE-2026-3055)
- [Citrix Community: NetScaler Security Bulletin Discussion](https://community.citrix.com/forums/topic/258854-netscaler-security-bulletin-for-cve-2026-3055-cve-2026-4368/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0277