Citrix — CraftedSignal Threat Feed

Citrix NetScaler ADC and Gateway CVE-2026-3055 Exploitation

hello@craftedsignal.io — Tue, 31 Mar 2026 12:00:00 +0000

A critical vulnerability, CVE-2026-3055, impacts Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML identity providers (IDP). Disclosed on March 23, 2026, and actively exploited since at least March 27, 2026, this flaw allows attackers to perform memory overreads via the /saml/login and /wsfed/passive endpoints. Successful exploitation enables the extraction of sensitive information, including authenticated administrative session IDs. The vulnerability affects versions…

Citrix Systems NetScaler Vulnerabilities Allow Information Disclosure and Session Hijacking

hello@craftedsignal.io — Tue, 24 Mar 2026 12:36:02 +0000

Citrix Systems NetScaler is vulnerable to multiple security flaws that could be exploited by remote attackers. These vulnerabilities, which can be leveraged by both anonymous and authenticated users, can lead to sensitive information disclosure and complete user session hijacking. The specific versions affected are not detailed in this advisory, but the broad scope suggests that numerous deployments are potentially at risk. Successful exploitation could grant unauthorized access to critical systems and data, impacting confidentiality and integrity. Defenders need to prioritize detection and mitigation strategies to protect their NetScaler instances.

Attack Chain

The attacker identifies a vulnerable NetScaler instance accessible over the network.
The attacker sends crafted requests to the NetScaler appliance to trigger an information disclosure vulnerability via the web interface (TCP 80 or 443).
The vulnerable NetScaler instance leaks sensitive information such as session tokens, internal IP addresses, or configuration details in its response.
The attacker analyzes the leaked information to identify valid user sessions.
The attacker crafts a new request, injecting the stolen session token, to bypass authentication.
The NetScaler instance, trusting the stolen session token, grants the attacker unauthorized access to the targeted user’s session.
The attacker gains complete control over the user’s session, impersonating the legitimate user and accessing their resources and data.
The attacker performs actions within the compromised session, such as accessing sensitive data, modifying configurations, or launching further attacks on the internal network.

Impact

Successful exploitation of these vulnerabilities allows attackers to gain unauthorized access to sensitive information and user sessions within Citrix NetScaler environments. The number of potential victims is vast, as NetScaler is widely used by organizations of all sizes across various sectors. If these attacks succeed, organizations could suffer significant data breaches, financial losses, and reputational damage. Session hijacking allows attackers to bypass normal authentication mechanisms, escalating the severity of the compromise.

Recommendation

Inspect web server logs for unusual request patterns targeting NetScaler instances to detect potential exploitation attempts (category: webserver, product: linux/windows).
Deploy the Sigma rule “Detect Suspicious NetScaler Session Hijacking” to identify potential session hijacking attempts based on unusual user-agent strings or source IP addresses (rule: Detect Suspicious NetScaler Session Hijacking).
Implement multi-factor authentication (MFA) for all NetScaler users to mitigate the impact of session token theft, even if the underlying vulnerabilities are not immediately patched.
Monitor NetScaler logs for unauthorized access attempts and unusual activity patterns following authentication (category: firewall, product: citrix).

Citrix NetScaler ADC and Gateway Vulnerabilities

hello@craftedsignal.io — Mon, 23 Mar 2026 19:03:59 +0000

On March 23, 2026, Citrix released a security advisory detailing several vulnerabilities affecting NetScaler ADC and NetScaler Gateway products. These vulnerabilities, if exploited, could lead to sensitive information disclosure and user session mix-up. While there is currently no evidence of active exploitation, the potential impact warrants immediate attention and remediation, particularly for internet-facing assets. The advisory urges organizations to update their affected NetScaler instances promptly and preserve any relevant logs for potential future investigations. This disclosure highlights the ongoing risk associated with perimeter security devices and the need for proactive patching and monitoring.

Attack Chain

An attacker identifies a vulnerable NetScaler ADC or Gateway instance accessible over the internet.
The attacker crafts a malicious HTTP request targeting a specific vulnerable endpoint or functionality within the NetScaler device.
The vulnerable NetScaler processes the malicious request without proper sanitization or validation.
Due to the vulnerability, the attacker gains unauthorized access to sensitive information, such as configuration details, session tokens, or user credentials.
Alternatively, the attacker exploits the vulnerability to manipulate user sessions, potentially hijacking legitimate user accounts.
The attacker uses the stolen credentials or hijacked sessions to access internal network resources or sensitive applications behind the NetScaler device.
The attacker exfiltrates sensitive data or performs unauthorized actions within the compromised internal network.

Impact

Successful exploitation of these vulnerabilities could lead to the disclosure of sensitive configuration data, including credentials and internal network topology. User session mix-up could grant attackers access to legitimate user accounts, allowing them to perform unauthorized actions and potentially compromise sensitive data. While the exact scope and number of potential victims is unknown, organizations using affected NetScaler products are at risk.

Recommendation

Immediately update affected NetScaler ADC and Gateway instances to the latest patched versions as recommended by Citrix in their security advisory [https://cert.europa.eu/publications/security-advisories/2026-003/].
Prioritize patching internet-facing NetScaler assets to minimize the attack surface.
Enable verbose logging on NetScaler devices and preserve logs for potential future incident investigation.
Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts against NetScaler devices.