CitrixBleed 3 — CVE-2026-3055 & CVE-2026-4368 NetScaler ADC/Gateway Memory Overread and Session Hijack

CitrixBleed 3 (TL-2026-0384), also tracked as CitrixBleed 3, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-17. It is attributed to UNC5174 + uncategorized Russian-nexus cluster (China, Russia) with medium confidence, affects Citrix NetScaler ADC, references 2 CVEs (CVE-2026-3055, CVE-2026-4368), maps to 23 MITRE ATT&CK techniques (T1016, T1021, T1040), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-0384

Threat ID
TL-2026-0384
Also known as
CitrixBleed 3, CB3, NetScalerBleed, CTX999201
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-17
Last reviewed
2026-04-17
Attribution
UNC5174 + uncategorized Russian-nexus cluster
Attribution confidence
MEDIUM
Nation-state nexus
China, Russia
Motivation
ESPIONAGE
Target sectors
government, defense, financial, healthcare, energy, manufacturing, legal, education, critical-infrastructure, telecommunications
Target regions
North America, Europe, APAC, Middle East
Detection rules
9
Indicators of compromise
28

Malware and tooling in CitrixBleed 3

Malware and tooling: CASTLERUN, ORB (Operational Relay Box) network, horizon3ai/CVE-2026-3055, watchtowrlabs/citrixbleed3

Two chained memory overread vulnerabilities in Citrix NetScaler ADC/Gateway (CVE-2026-3055 sensitive information disclosure via malformed POST to /nf/auth/doAuthentication.do; CVE-2026-4368 authentication bypass in the AAA virtual server TLS handshake) allow unauthenticated network attackers to exfiltrate session tokens, NSC_AAAC cookies, decrypted credentials, and Active Directory secrets directly from uninitialized heap memory. Dubbed 'CitrixBleed 3' due to lineage with CVE-2023-4966 (CitrixBleed 1) and CVE-2025-5777 (CitrixBleed 2). CISA KEV listing and Mandiant have confirmed active exploitation by multiple intrusion sets, including UNC5174 and an uncategorized Russian-nexus cluster staging ransomware precursors.

How CitrixBleed 3 works

CitrixBleed 3 is an exploitation chain that couples two independent flaws in Citrix NetScaler ADC and NetScaler Gateway firmware.

CVE-2026-3055 is an out-of-bounds read in the authentication daemon (nsauthd) triggered when the Gateway receives an HTTP POST to /nf/auth/doAuthentication.do with an oversized Content-Length header and a truncated login= form field. The parser reads a fixed-size buffer based on Content-Length but terminates copying at the first NULL byte in the POST body, leaving the buffer tail populated with process heap memory. The response payload echoes this buffer in the response 'Set-Cookie' and HTML body, leaking up to 127 bytes of adjacent heap per request. Repeated requests drift across the heap and extract NSC_AAAC session cookies, TLS session keys, and plaintext fragments of AAA credentials.

CVE-2026-4368 is an authentication bypass in the AAA virtual server TLS client-certificate handshake. The NetScaler ADC accepts a crafted ClientHello referencing session-id 0x00 plus a renegotiation_info extension with length set to 0xFFFF, which causes nsaaad to resume a non-existent session and bind the resulting connection to the NSROOT administrative context. Combined, the two flaws allow an unauthenticated attacker to harvest a valid NSC_AAAC cookie via CVE-2026-3055, then promote it to NSROOT privileges via CVE-2026-4368, achieving full-domain pass-through and RDP/ICA session hijack.

Active exploitation was first observed on 2026-03-27 by Mandiant's Managed Defense team against a US defense integrator. The Citrix Security Bulletin CTX999201 was released on 2026-04-14; CISA added both CVEs to KEV on 2026-04-15 with a remediation due date of 2026-04-29. Multiple public PoCs (notably horizon3ai/CVE-2026-3055 and watchTowr/citrixbleed3) were published on 2026-04-16 and are being weaponized rapidly.

Affected builds: NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-59.19, 13.1-FIPS before 13.1-37.207, 12.1-FIPS before 12.1-55.328, and 12.1-NDcPP before 12.1-55.328. End-of-life builds 12.0 and 11.1 are permanently vulnerable. The vulnerability surface requires only that the appliance be configured as a Gateway (VPN virtual server) or AAA virtual server — the default posture for most enterprise deployments.

MITRE ATT&CK techniques used in TL-2026-0384

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery

Lateral Movement

T1021 Remote Services

Credential Access

T1040 Network Sniffing; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1573 Encrypted Channel

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Persistence

T1505 Server Software Component

Impact

T1531 Account Access Removal

lateral-movement

T1550 Use Alternate Authentication Material

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CitrixBleed 3

  • Citrix — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-43.56; 13.1 before 13.1-59.19; 13.1-FIPS before 13.1-37.207; 12.1-FIPS before 12.1-55.328; 12.1-NDcPP before 12.1-55.328; 12.0 (end-of-life); 11.1 (end-of-life)
    Fixed in: 14.1-43.56; 13.1-59.19; 13.1-FIPS 13.1-37.207; 12.1-FIPS 12.1-55.328; 12.1-NDcPP 12.1-55.328
  • Citrix — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-43.56; 13.1 before 13.1-59.19
    Fixed in: 14.1-43.56; 13.1-59.19

Remediation for CitrixBleed 3

Patches

  • NetScaler ADC and Gateway 14.1-43.56 and later
  • NetScaler ADC and Gateway 13.1-59.19 and later
  • NetScaler ADC 13.1-FIPS 13.1-37.207 and later
  • NetScaler ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.328 and later
  • Citrix Security Bulletin CTX999201

Immediate actions

  • Apply Citrix fixed builds: 14.1-43.56+, 13.1-59.19+, 13.1-FIPS 13.1-37.207+, 12.1-FIPS/NDcPP 12.1-55.328+
  • After patching, terminate ALL active ICA and PCoIP sessions: 'kill aaa session -all' and 'kill icaconnection -all'
  • Rotate all NSC_AAAC, NSC_REPLACE, and nsroot credentials — tokens harvested pre-patch remain valid
  • Block inbound /nf/auth/doAuthentication.do with anomalous Content-Length (>1024) at upstream WAF/proxy
  • Enable NetScaler audit logging SYSLOG level INFORMATIONAL for nsauthd and nsaaad

Workarounds

  • If patching is impossible within 48h, disable the Gateway VPN and AAA virtual servers: 'disable vserver <name>'
  • Restrict Gateway ingress to trusted source networks via ACL on upstream firewall
  • Force all sessions to re-authenticate by restarting nsaaad and clearing session table

Longer-term hardening

  • Segment NetScaler management interface (NSIP) to dedicated admin VLAN — never expose to Internet
  • Enforce certificate-based multi-factor authentication on AAA virtual servers
  • Deploy EDR agent on NetScaler Linux shell where supported (13.1+) for integrity monitoring
  • Subscribe to Citrix Security Bulletins RSS feed — CTX advisories often pre-disclose to partners
  • Build hunt playbook for /var/log/ns.log 'info' entries containing 'login failed: invalid content-length'

CVEs associated with CitrixBleed 3

CVE-2026-3055, CVE-2026-4368

Weaknesses (CWE) in CitrixBleed 3

CWE-125, CWE-200, CWE-287, CWE-384, CWE-908

Timeline of CitrixBleed 3

  • CitrixBleed 1 (CVE-2023-4966) disclosed — session token leak in NetScaler ADC establishing the bleed class of vulnerability.
  • CitrixBleed 2 (CVE-2025-5777) disclosed — follow-on memory disclosure fixed in 14.1-43.52 and 13.1-58.32.
  • Citrix internal fuzzing identifies nsauthd Content-Length parsing flaw later assigned CVE-2026-3055.
  • Assetnote researchers independently report CVE-2026-4368 AAA TLS renegotiation bypass to Citrix under coordinated disclosure.
  • Mandiant Managed Defense observes first in-the-wild exploitation against a US defense integrator — attributed to UNC5174.
  • Second exploitation cluster (Russian-nexus) observed staging ransomware tooling after NetScaler compromise.
  • Citrix releases Security Bulletin CTX999201 with fixed builds 14.1-43.56 and 13.1-59.19.
  • CISA adds CVE-2026-3055 and CVE-2026-4368 to Known Exploited Vulnerabilities catalog with remediation due date 2026-04-29.
  • Mandiant publishes public blog detailing active exploitation and TTPs of UNC5174 CitrixBleed 3 campaign.
  • Shadowserver and GreyNoise report mass scanning for /nf/auth/doAuthentication.do across Internet-exposed NetScaler devices.
  • horizon3ai and watchTowr Labs publish proof-of-concept exploits on GitHub; weaponization accelerates.
  • Threadlinqs Intelligence platform begins tracking CitrixBleed 3 as TL-2026-0384 with full detection coverage.
  • As of 2026-05-29, CitrixBleed 3 (CVE-2026-3055) remains an active, critical NetScaler ADC/Gateway memory-overread flaw: in CISA KEV since 2026-03-30, exploited in the wild since ~03-27 with public PoCs and ransomware-precursor concerns. Patches exist but large unpatched internet-exposed install base and pre-harvested session tokens keep it a live threat.

Sources cited for CitrixBleed 3

Threats related to CitrixBleed 3

Detection coverage for TL-2026-0384

As of 2026-04-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0384 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats