NetScaler - Memory Disclosure (CVE-2026-3055)

CVE-2026-3055 is a critical memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider. Due to insufficient input validation, unauthenticated attackers can trigger an out-of-bounds read that leaks sensitive memory contents, including administrative session cookies, potentially enabling full appliance compromise.

CrowdSec has been tracking this vulnerability and its exploits since 30th of March 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-3055 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-3055 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-3055 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the SAML IDP endpoints by sending crafted POST requests to /saml/login with a malicious SAMLRequest payload, or GET requests to /wsfed/passive?wctx with an empty parameter value, triggering memory overread that leaks sensitive data such as session cookies in the NSC_TASS cookie.