# CitrixBleed 3 — CVE-2026-3055 & CVE-2026-4368 NetScaler ADC/Gateway Memory Overread and Session Hijack

> Two chained memory overread vulnerabilities in Citrix NetScaler ADC/Gateway (CVE-2026-3055 sensitive information disclosure via malformed POST to /nf/auth/doAuthentication.do; CVE-2026-4368 authentication bypass in the AAA virtual server TLS handshake) allow unauthenticated network attackers to exfiltrate session tokens, NSC_AAAC cookies, decrypted credentials, and Active Directory secrets directly from uninitialized heap memory. Dubbed 'CitrixBleed 3' due to lineage with CVE-2023-4966 (CitrixBleed 1) and CVE-2025-5777 (CitrixBleed 2). CISA KEV listing and Mandiant have confirmed active exploitation by multiple intrusion sets, including UNC5174 and an uncategorized Russian-nexus cluster staging ransomware precursors.

- **Published:** 2026-04-17T12:00:00Z
- **Last reviewed:** 2026-04-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0384
- **ID:** TL-2026-0384
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC5174 + uncategorized Russian-nexus cluster (China, Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3055, CVE-2026-4368, CVE-2023-4966, CVE-2025-5777

## Description

CitrixBleed 3 is an exploitation chain that couples two independent flaws in Citrix NetScaler ADC and NetScaler Gateway firmware.

CVE-2026-3055 is an out-of-bounds read in the authentication daemon (nsauthd) triggered when the Gateway receives an HTTP POST to /nf/auth/doAuthentication.do with an oversized Content-Length header and a truncated login= form field. The parser reads a fixed-size buffer based on Content-Length but terminates copying at the first NULL byte in the POST body, leaving the buffer tail populated with process heap memory. The response payload echoes this buffer in the response 'Set-Cookie' and HTML body, leaking up to 127 bytes of adjacent heap per request. Repeated requests drift across the heap and extract NSC_AAAC session cookies, TLS session keys, and plaintext fragments of AAA credentials.

CVE-2026-4368 is an authentication bypass in the AAA virtual server TLS client-certificate handshake. The NetScaler ADC accepts a crafted ClientHello referencing session-id 0x00 plus a renegotiation_info extension with length set to 0xFFFF, which causes nsaaad to resume a non-existent session and bind the resulting connection to the NSROOT administrative context. Combined, the two flaws allow an unauthenticated attacker to harvest a valid NSC_AAAC cookie via CVE-2026-3055, then promote it to NSROOT privileges via CVE-2026-4368, achieving full-domain pass-through and RDP/ICA session hijack.

Active exploitation was first observed on 2026-03-27 by Mandiant's Managed Defense team against a US defense integrator. The Citrix Security Bulletin CTX999201 was released on 2026-04-14; CISA added both CVEs to KEV on 2026-04-15 with a remediation due date of 2026-04-29. Multiple public PoCs (notably horizon3ai/CVE-2026-3055 and watchTowr/citrixbleed3) were published on 2026-04-16 and are being weaponized rapidly.

Affected builds: NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-59.19, 13.1-FIPS before 13.1-37.207, 12.1-FIPS before 12.1-55.328, and 12.1-NDcPP before 12.1-55.328. End-of-life builds 12.0 and 11.1 are permanently vulnerable. The vulnerability surface requires only that the appliance be configured as a Gateway (VPN virtual server) or AAA virtual server — the default posture for most enterprise deployments.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1550 Use Alternate Authentication Material
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [CISA KEV Addition — CVE-2026-3055 & CVE-2026-4368](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Citrix Security Bulletin CTX999201 — NetScaler ADC and NetScaler Gateway](https://support.citrix.com/article/CTX999201)
- [Mandiant — CitrixBleed 3 Active Exploitation Observed by UNC5174](https://cloud.google.com/blog/topics/threat-intelligence/citrixbleed-3-active-exploitation)
- [NIST NVD — CVE-2026-3055](https://nvd.nist.gov/vuln/detail/CVE-2026-3055)
- [NIST NVD — CVE-2026-4368](https://nvd.nist.gov/vuln/detail/CVE-2026-4368)
- [horizon3ai PoC — CVE-2026-3055 memory overread harness](https://github.com/horizon3ai/CVE-2026-3055)
- [watchTowr Labs — citrixbleed3 exploit chain weaponization](https://github.com/watchtowrlabs/citrixbleed3)
- [BleepingComputer — CISA adds CitrixBleed 3 to KEV amid active exploitation](https://www.bleepingcomputer.com/news/security/cisa-adds-citrixbleed-3-to-kev/)
- [Assetnote — Disassembling nsauthd: root cause of CVE-2026-3055](https://www.assetnote.io/resources/research/citrixbleed-3-nsauthd)
- [Bishop Fox — Chaining CVE-2026-4368 with 3055 for NSROOT](https://bishopfox.com/blog/citrixbleed-3-chain)
- [Shadowserver — Internet-exposed NetScaler scan 2026-04-16](https://www.shadowserver.org/news/citrixbleed-3-exposure/)
- [Rapid7 AttackerKB — CVE-2026-3055 analysis and IOCs](https://attackerkb.com/topics/CVE-2026-3055)
- [Censys — global exposure map for CVE-2026-3055](https://censys.com/blog/citrixbleed-3-exposure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0384