Loading vulnerability…
CVE-2026-3055 is a critical out-of-bounds read vulnerability in NetScaler ADC and NetScaler Gateway caused by insufficient input validation when the appliance is configured as a SAML Identity Provider. The flaw allows malformed remote requests to trigger a memory overread condition, causing the appliance to read data outside intended bounds and disclose sensitive process memory. Affected releases include NetScaler ADC and Gateway 14.1 before 14.1-66.59, 13.1 before 13.1-62.23, and NetScaler ADC FIPS and NDcPP before 13.1-37.262. The issue has been associated with active exploitation and has been compared to prior CitrixBleed-class memory disclosure flaws because exposed memory may contain authentication material and other sensitive runtime data.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a multi-script Python exploit toolkit for CVE-2026-3055, described as a Citrix NetScaler ADC / Gateway memory overread affecting systems configured as a SAML IdP. It is not tied to a known exploitation framework; instead it is a standalone repository with one main exploit and three supporting utilities. Repository structure: the main operational file is exploit.py, which performs vulnerability checking, repeated triggering of the vulnerable endpoint, decoding of the NSC_TASS cookie, extraction of sensitive data from leaked memory, optional session harvesting, and report generation. detectors/vulnerability_checker.py is a lighter-weight detector that only checks whether the target appears vulnerable by requesting /wsfed/passive?wctx and inspecting the returned NSC_TASS cookie. memory_leaker.py is a continuous polling tool that repeatedly hits the same endpoint and prints likely session IDs or cookies found in decoded memory. session_harvester.py is a focused post-exploitation helper that repeatedly collects leaked data, extracts candidate session IDs with regexes, saves them to JSON, and can test a supplied session by replaying it as NSC_TASS and NSC_AAAC against /vpn/index.html. The remaining files are documentation, usage examples, and requirements. Exploit capability: the code performs unauthenticated network/web requests to the target appliance, specifically to /wsfed/passive?wctx, and treats the NSC_TASS cookie as the memory disclosure channel. It base64-decodes the cookie, checks for unusually large decoded content as a sign of vulnerability, and searches leaked memory for session-like strings, cookie material, and other sensitive data. The toolkit is clearly intended to support session theft and administrative session hijacking rather than code execution. The session_harvester component extends this by storing unique sessions and testing whether replayed cookies yield access to /vpn/index.html. Notable observables: the primary fingerprintable target path is /wsfed/passive?wctx, used in all exploit components. A secondary path, /vpn/index.html, is used to validate harvested sessions. Cookie names NSC_TASS, NSC_TEMP, and NSC_AAAC are central to the logic. Example output files include harvested_sessions.json, sessions.json, and report.json. The code disables TLS certificate verification globally for requests sessions. Assessment: this is a real exploit-oriented repository, not just a detector, because it automates repeated triggering of the bug, extracts sensitive data from leaked memory, and includes session replay/testing logic for hijacking. It is best classified as OPERATIONAL rather than WEAPONIZED because the payload is fixed to this vulnerability and target workflow, but it provides practical post-exploitation utility.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
309 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Citrix NetScaler vulnerability that the threat actor successfully exploited in manual attacks to extract memory and search for authentication cookies for session hijacking.
A memory-overread vulnerability in Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers that was reportedly used for data exfiltration from three organizations.
A critical Citrix NetScaler out-of-bounds memory read vulnerability that the actor manually exploited successfully for data exfiltration and apparent session hijacking activity.
A related Citrix NetScaler memory-overread vulnerability in the CitrixBleed family that was patched in March 2026 and later confirmed exploited.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.