Loading story…
Attackers are exploiting CVE-2026-3055, a CVSS 9.3 memory-overread vulnerability affecting Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers. Citrix disclosed the flaw on March 23, 2026; Defused Cyber and CrowdSec reported exploitation traces beginning March 27, with Defused Cyber observing widespread exploitation by March 29 and CrowdSec reporting more than 40 probing IP addresses over that weekend. Honeypot telemetry showed earlier attempts against older CitrixBleed vulnerabilities, followed by authentication-method enumeration and probing of federated-authentication endpoints.
Crafted SAML requests missing the AssertionConsumerServiceURL attribute reportedly disclose adjacent heap memory through the NSC_TASS response cookie, potentially exposing session material. WatchTowr identified disclosure through /saml/login and a more reliable leak through /wsfed/passive?wctx, with testing exposing active administrative session data. Organizations running affected configurations should immediately install the fixed releases specified in Citrix bulletin CTX696300. Where patching is delayed, restrict external access to relevant SAML, authentication, and management endpoints, and review logs for reconnaissance and exploitation indicators.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
By March 29, Defused Cyber observed widespread exploitation using crafted SAMLRequest payloads sent to /saml/login, with most retaining values from watchTowr's proof of concept. CrowdSec also reported more than 40 probing IP addresses over the weekend, predominantly hosted on Amazon infrastructure associated with AS16509.
Defused Cyber and CrowdSec reported initial CVE-2026-3055 exploitation activity beginning March 27, four days after Citrix's disclosure. Defused Cyber's timestamped examples in that section show reconnaissance requests rather than exploit payloads.
At 12:28 UTC on March 27, 38.54.88.49 requested /wsfed/passive?test&wctx on a NetScaler decoy. The report interprets the request as testing federated-authentication endpoint availability and context-parameter processing before exploit delivery.
At 00:19 UTC on March 27, 45.77.108.53 sent a POST request to /cgi/GetAuthMethods on a NetScaler honeypot. The report identifies this activity as reconnaissance to find appliances configured as SAML identity providers.
Citrix published bulletin CTX696300, disclosing CVE-2026-3055 and the lower-severity CVE-2026-4368 with patching guidance. CVE-2026-3055 is an unauthenticated memory-overread vulnerability rated CVSS 9.3 that affects NetScaler ADC and Gateway appliances configured as SAML identity providers.
On March 16, honeypots recorded more than 500 exploit attempts targeting CVE-2025-5777 and CVE-2023-4966 within 24 hours across multiple regions. The activity exceeded baseline levels, but the report did not establish a connection to advance knowledge of CVE-2026-3055.
Follow-up research identified /wsfed/passive?wctx as a second memory-disclosure path, triggered by supplying the wctx parameter without a value. watchTowr found that this path leaked substantially more data more reliably than the SAML variant, including active administrative session data during testing.
watchTowr's initial research identified memory disclosure through /saml/login, and a public proof of concept was subsequently reflected in observed attack payloads. Malformed SAML requests omitting AssertionConsumerServiceURL reportedly cause adjacent heap contents to appear in the NSC_TASS response cookie.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
defusedcyber.com
Open sourcecrowdsec.net
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Three vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway—CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543—have prompted urgent patching and compromise checks. CVE-2025-5777, nicknamed **CitrixBleed 2**, is a memory-overread flaw that could expose session tokens and plaintext credentials. Horizon3.ai demonstrated an attack believed to exploit it through the `/p/u/doAuthentication.do` endpoint, leaking up to 127 bytes of adjacent memory. GreyNoise has observed malicious attempts targeting the flaw, but its reference does not establish successful exploitation. Citrix said it had not observed exploitation of CVE-2025-5777 at the time of the research, a position disputed by some security firms. Separately, Citrix acknowledged active exploitation of CVE-2025-6543, a memory-corruption vulnerability with potential control-flow or denial-of-service impact, which CISA added to its Known Exploited Vulnerabilities catalog. The Dutch National Cyber Security Centre urged affected organizations to **install Citrix updates promptly, investigate indicators of compromise, and terminate connections and sessions after patching** so stolen sessions cannot preserve attacker access. The Netherlands Public Prosecution Service disconnected its systems from the internet after indications of abuse. Defenders should review logs for non-printable characters, investigate sessions used from multiple client IP addresses, and check for unauthorized accounts or configuration changes. Multiple NetScaler versions, including FIPS/NDcPP builds, are affected; organizations should verify their appliances against the relevant advisories. The NCSC warned that NetScaler and other internet-facing edge devices are attractive targets because their compromise can provide further access to organizational networks.
Oct 9, 2026
Citrix disclosed **CVE-2026-107406**, a critical memory-overflow vulnerability in NetScaler ADC and NetScaler Gateway with a **CVSS v4.0 score of 9.5**. Successful exploitation could cause remote code execution or denial of service, depending on the appliance build and SAML identity-provider or service-provider configuration. Advisory CTX697191 also covers affected appliances used in Secure Private Access Hybrid deployments. Citrix stated that it was not aware of any unmitigated exploits at publication; Beazley Security Labs reported no known public proof of concept or independent technical analysis. Administrators should verify appliance versions and SAML configurations, then upgrade to the applicable fixed release, including **14.1-73.46** or **13.1-64.29** for standard editions, with separate fixes for FIPS editions. Citrix has not published a workaround; temporary exposure reductions and monitoring can supplement, but not replace, patching. Recent exploitation of three other NetScaler vulnerabilities, including a separate SAML-processing flaw, heightens the urgency. Security teams should investigate suspicious activity on previously exposed appliances, because installing a fix does not establish whether an earlier compromise occurred.
Oct 9, 2026