CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler "CitrixBleed 3" Memory Overread

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler "CitrixBleed 3" Memory Overread

Key Points

  • CVE-2026-3055 is a critical (CVSS v4.0 9.3) unauthenticated memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers.
  • Attackers send malformed requests to /saml/login (omitting AssertionConsumerServiceURL) or to /wsfed/passive?wctx (with a valueless wctx parameter) and read kilobytes of leftover process memory — including session tokens, SAML assertions, and LDAP credentials — base64-encoded in the NSC_TASSresponse cookie.
  • A companion bug, CVE-2026-4368 (CVSS 7.7), is a race condition that mixes user sessions on Gateway/AAA Vservers and affects only build 14.1-66.54.
  • CISA added CVE-2026-3055 to the KEV catalog on 30 March 2026 with a federal patch deadline of 2 April 2026.
  • Active exploitation is confirmed.
  • Patch to 14.1-66.59, 13.1-62.23, or 13.1-FIPS/NDcPP 13.1-37.262 now.

At-a-Glance Vulnerability Facts

Attribute

CVE-2026-3055

CVE-2026-4368

Vendor advisory

Citrix CTX696300

Citrix CTX696300

CWE

CWE-125: Out-of-bounds Read

CWE-362: Race Condition

CVSS v4.0

9.3 (Critical)

7.7 (High)

Vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Authentication required

None (pre-auth)

Low privileges

Precondition

Appliance configured as SAML IdP

Appliance configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver

Affected versions

NetScaler 14.1 < 14.1-66.59; 13.1 < 13.1-62.23; 13.1-FIPS / 13.1-NDcPP < 13.1-37.262

Only build 14.1-66.54

Fixed in

14.1-60.58, 14.1-66.59+, 13.1-62.23+, 13.1-FIPS/NDcPP 13.1-37.262+

14.1-66.59+

CISA KEV

Added 30 Mar 2026

Not listed (yet)

In-the-wild exploitation

Confirmed (since ~27 Mar 2026)

Not publicly confirmed

Impact

Unauthenticated disclosure of process memory (session tokens, SAML assertions, credentials)

Cross-user session hijack via race

Article Link: https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread