Threat reportVulnerabilityTL-2026-4823
Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via /wsfed/passive?wctx — Session Leak, Exploited in the Wild
Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via (TL-2026-4823), also tracked as CitrixBleed 3, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-30. It has no confirmed attribution, affects Citrix (Cloud Software Group) NetScaler ADC and NetScaler Gateway, references 2 CVEs (CVE-2026-3055, CVE-2026-4368), maps to 6 MITRE ATT&CK techniques (T1078, T1190, T1212), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4823
- Threat ID
- TL-2026-4823
- Also known as
- CitrixBleed 3, NetScaler SAML IDP Memory Overread
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
Malware and tooling: watchTowr detection artifact generator (Python)
How Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via works
watchTowr Labs analyzes a second memory overread behind CVE-2026-3055 in Citrix NetScaler ADC/Gateway configured as a SAML IDP, triggered by sending /wsfed/passive?wctx with no value. Kilobytes of uninitialized memory leak base64-encoded in the NSC_TASS cookie, potentially exposing authenticated administrative session IDs; exploitation was observed from about 2026-03-27 and CISA added the CVE to KEV on 2026-03-30.
CVE-2026-3055 (Citrix advisory CTX696300, disclosed 2026-03-23, described as 'insufficient input validation leading to memory overread') affects NetScaler ADC and NetScaler Gateway only when the appliance is configured as a SAML Identity Provider (IDP). watchTowr Labs showed that the CVE actually covers at least two distinct out-of-bounds read (CWE-125) bugs on two endpoints: /saml/login (Part 1, malformed SAML request omitting the AssertionConsumerServiceURL attribute) and /wsfed/passive?wctx (Part 2).
In the Part 2 primitive, an unauthenticated attacker sends GET /wsfed/passive?wctx with the wctx parameter present but with no '=' sign and no value. The appliance checks only for the presence of the parameter before accessing the associated buffer, so it dereferences uninitialized memory. The vulnerable device answers with a 302 redirect and returns the leaked memory, base64-encoded, in the NSC_TASS cookie. watchTowr reports it works 'every(ish) time' and discloses kilobytes per request, with no data-quantity limit unlike the first primitive; repeated requests return different memory chunks, allowing an attacker to harvest session tokens, SAML assertions, LDAP credentials and active administrative session IDs for session hijacking. The pattern mirrors CitrixBleed 2 (CVE-2025-5777), and the issue has been nicknamed 'CitrixBleed 3' by some vendors.
Exploitation timeline: Defused Cyber and watchTowr's Attacker Eye honeypots saw reconnaissance against /cgi/GetAuthMethods (to fingerprint enabled authentication flows) on 2026-03-27, and watchTowr confirmed in-the-wild exploitation from known threat-actor source IPs by the same date. CrowdSec reported more than 40 probing IPs, mostly on AWS (AS16509). CISA added CVE-2026-3055 to the KEV catalog on 2026-03-30 with a federal deadline of 2026-04-02. A related, separate bug CVE-2026-4368 (race condition, CWE-362, CVSS v4 7.7) affects only build 14.1-66.54 and was not KEV-listed at the time of the Picus write-up.
Defenders should patch, confirm whether any appliance is configured as a SAML IDP, and, where exposure is possible, treat sessions and secrets as compromised: invalidate NSC_AAAC, NSC_TMAS and NSC_TASS sessions, force re-authentication, and rotate LDAP bind credentials, SAML signing keys and service-account passwords. No specific attacker IPs, user-agents or malware were published in the sources reviewed; actor attribution is unknown.
MITRE ATT&CK techniques used in TL-2026-4823
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie
lateral-movement
Lateral Movement
Reconnaissance
Affected products and versions in Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
- Citrix (Cloud Software Group) — NetScaler ADC and NetScaler Gateway (configured as SAML IDP)
Vulnerable versions: 14.1 before 14.1-60.58; 14.1 before 14.1-66.59; 13.1 before 13.1-62.23; 13.1-FIPS/NDcPP before 13.1-37.262
Fixed in: 14.1-60.58; 14.1-66.59; 13.1-62.23; 13.1-FIPS/NDcPP 13.1-37.262 - Citrix (Cloud Software Group) — NetScaler Gateway/AAA vserver (CVE-2026-4368 only)
Vulnerable versions: 14.1-66.54
Fixed in: 14.1-66.59
Remediation for Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
Patches
- NetScaler 14.1-60.58 or later
- NetScaler 14.1-66.59 or later
- NetScaler 13.1-62.23 or later
- NetScaler 13.1-FIPS/NDcPP 13.1-37.262 or later (Citrix advisory CTX696300)
Immediate actions
- Identify NetScaler ADC/Gateway appliances configured as a SAML IDP and prioritize them for patching
- Invalidate NSC_AAAC, NSC_TMAS and NSC_TASS sessions and force re-authentication of all users
- Rotate LDAP bind credentials, SAML signing keys and service-account passwords if exposure is possible
- Hunt for GET /wsfed/passive?wctx (valueless) requests, /saml/login requests missing AssertionConsumerServiceURL, and external GET /cgi/GetAuthMethods
Workarounds
- No workaround documented in the reviewed sources; exposure requires the appliance to be configured as a SAML IDP
Longer-term hardening
- Reduce internet exposure of NetScaler management and authentication endpoints
- Review whether the SAML IDP deployment model on the appliance is required
- Monitor for anomalous VPN logins, ICA Proxy sessions outside business hours and RDP Proxy sessions from unfamiliar source IPs
CVEs associated with Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
Weaknesses (CWE) in Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
Timeline of Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
- Citrix publishes advisory CTX696300 disclosing CVE-2026-3055 (insufficient input validation leading to memory overread) in NetScaler ADC/Gateway configured as a SAML IDP; found by Citrix's internal product security efforts
- watchTowr confirms in-the-wild exploitation of the /wsfed/passive?wctx overread from known threat-actor source IPs; CrowdSec also dates early exploitation to this day
- Defused Cyber and watchTowr Attacker Eye honeypots observe reconnaissance against /cgi/GetAuthMethods to fingerprint NetScaler authentication flows
- watchTowr Labs publishes Part 2 analysis of the /wsfed/passive?wctx memory overread leaking data via the NSC_TASS cookie, with a detection artifact generator
- CISA adds CVE-2026-3055 to the Known Exploited Vulnerabilities catalog
- Federal remediation deadline for CVE-2026-3055 under CISA KEV
Sources cited for Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via
- Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread - Part 2)
- The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread) - Part 1
- Rapid Reaction - Citrix NetScaler ADC and NetScaler Gateway Memory Overread Vulnerability (CVE-2026-3055)
- CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler CitrixBleed 3 Memory Overread (Picus Security)
- CVE-2026-3055 Citrix NetScaler Memory Leak Exploitation (CrowdSec)
- Urgent Alert: NetScaler bug CVE-2026-3055 probed by attackers could leak sensitive data (Security Affairs)
- CVE-2026-3055 attack research (Horizon3.ai)
- Citrix NetScaler Under Active Recon for CVE-2026-3055 (The Hacker News)
- NVD - CVE-2026-3055
Detection coverage for TL-2026-4823
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4823 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.