# Citrix NetScaler CVE-2026-3055 Memory Overread (Part 2) via /wsfed/passive?wctx — Session Leak, Exploited in the Wild

> watchTowr Labs analyzes a second memory overread behind CVE-2026-3055 in Citrix NetScaler ADC/Gateway configured as a SAML IDP, triggered by sending /wsfed/passive?wctx with no value. Kilobytes of uninitialized memory leak base64-encoded in the NSC_TASS cookie, potentially exposing authenticated administrative session IDs; exploitation was observed from about 2026-03-27 and CISA added the CVE to KEV on 2026-03-30.

- **Published:** 2026-10-30T12:14:45Z
- **Last reviewed:** 2026-10-30T12:14:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4823
- **ID:** TL-2026-4823
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-3055, CVE-2026-4368

## Description

CVE-2026-3055 (Citrix advisory CTX696300, disclosed 2026-03-23, described as 'insufficient input validation leading to memory overread') affects NetScaler ADC and NetScaler Gateway only when the appliance is configured as a SAML Identity Provider (IDP). watchTowr Labs showed that the CVE actually covers at least two distinct out-of-bounds read (CWE-125) bugs on two endpoints: /saml/login (Part 1, malformed SAML request omitting the AssertionConsumerServiceURL attribute) and /wsfed/passive?wctx (Part 2).

In the Part 2 primitive, an unauthenticated attacker sends GET /wsfed/passive?wctx with the wctx parameter present but with no '=' sign and no value. The appliance checks only for the presence of the parameter before accessing the associated buffer, so it dereferences uninitialized memory. The vulnerable device answers with a 302 redirect and returns the leaked memory, base64-encoded, in the NSC_TASS cookie. watchTowr reports it works 'every(ish) time' and discloses kilobytes per request, with no data-quantity limit unlike the first primitive; repeated requests return different memory chunks, allowing an attacker to harvest session tokens, SAML assertions, LDAP credentials and active administrative session IDs for session hijacking. The pattern mirrors CitrixBleed 2 (CVE-2025-5777), and the issue has been nicknamed 'CitrixBleed 3' by some vendors.

Exploitation timeline: Defused Cyber and watchTowr's Attacker Eye honeypots saw reconnaissance against /cgi/GetAuthMethods (to fingerprint enabled authentication flows) on 2026-03-27, and watchTowr confirmed in-the-wild exploitation from known threat-actor source IPs by the same date. CrowdSec reported more than 40 probing IPs, mostly on AWS (AS16509). CISA added CVE-2026-3055 to the KEV catalog on 2026-03-30 with a federal deadline of 2026-04-02. A related, separate bug CVE-2026-4368 (race condition, CWE-362, CVSS v4 7.7) affects only build 14.1-66.54 and was not KEV-listed at the time of the Picus write-up.

Defenders should patch, confirm whether any appliance is configured as a SAML IDP, and, where exposure is possible, treat sessions and secrets as compromised: invalidate NSC_AAAC, NSC_TMAS and NSC_TASS sessions, force re-authentication, and rotate LDAP bind credentials, SAML signing keys and service-account passwords. No specific attacker IPs, user-agents or malware were published in the sources reviewed; actor attribution is unknown.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1550.004 Web Session Cookie
- T1078 Valid Accounts

## Sources

- [Please, We Beg, Just One Weekend Free Of Appliances (Citrix NetScaler CVE-2026-3055 Memory Overread - Part 2)](https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/)
- [The Sequels Are Never As Good, But We're Still In Pain (Citrix NetScaler CVE-2026-3055 Memory Overread) - Part 1](https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread/)
- [Rapid Reaction - Citrix NetScaler ADC and NetScaler Gateway Memory Overread Vulnerability (CVE-2026-3055)](https://watchtowr.com/?p=2682)
- [CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler CitrixBleed 3 Memory Overread (Picus Security)](https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread)
- [CVE-2026-3055 Citrix NetScaler Memory Leak Exploitation (CrowdSec)](https://www.crowdsec.net/vulntracking-report/cve-2026-3055-citrix-netscaler-memory-leak-exploitation)
- [Urgent Alert: NetScaler bug CVE-2026-3055 probed by attackers could leak sensitive data (Security Affairs)](https://securityaffairs.com/?p=190131)
- [CVE-2026-3055 attack research (Horizon3.ai)](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-3055/)
- [Citrix NetScaler Under Active Recon for CVE-2026-3055 (The Hacker News)](https://thehackernews.com/2026/03/citrix-netscaler-under-active-recon-for.html)
- [NVD - CVE-2026-3055](https://nvd.nist.gov/vuln/detail/CVE-2026-3055)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4823