Attack Chain

1. The attacker identifies a vulnerable Citrix NetScaler ADC or Gateway appliance configured as a SAML IdP.
2. The attacker sends a crafted request to the /saml/login or /wsfed/passive endpoint.
3. Due to the memory overread vulnerability (CVE-2026-3055), the appliance leaks sensitive information from its memory.
4. The leaked information includes authenticated administrative session IDs.
5. The attacker captures the leaked administrative session IDs.
6. The attacker uses the captured session IDs to authenticate to the NetScaler appliance with administrative privileges.
7. The attacker gains full control over the NetScaler appliance.
8. The attacker can then perform further actions such as data exfiltration, configuration changes, or deploying malicious payloads.

Impact

Successful exploitation of CVE-2026-3055 can lead to full takeover of vulnerable Citrix NetScaler ADC and Gateway appliances. This allows attackers to steal sensitive data, modify configurations, and potentially pivot to internal networks. With approximately 29,000 exposed NetScaler and 2,250 Gateway instances online, a significant number of organizations are potentially at risk. The compromise of these appliances can disrupt critical services, lead to data breaches, and damage organizational reputation.

Recommendation

• Immediately patch all Citrix NetScaler ADC and Gateway appliances to versions 14.1-60.58, 13.1-62.23, or 13.1-37.262 or later to remediate CVE-2026-3055 and CVE-2026-4368.
• Apply mitigations if patching is not immediately feasible, focusing on appliances configured as SAML identity providers (IDP).
• Deploy the Sigma rules provided in this brief to your SIEM to detect exploitation attempts against the /saml/login and /wsfed/passive endpoints.
• Review logs for unusual activity on NetScaler appliances, particularly requests to the /saml/login and /wsfed/passive endpoints, to identify potential exploitation attempts.