VULNpocalypse
CriticalVulnerabilityPatch available

Citrix NetScaler “CitrixBleed 3” CVE-2026-3055 and its sequels CVE-2026-8451 and CVE-2026-8452: SAML memory leaks and a Gateway RCE

SAML IdP memory leaks and a Gateway memory bug in NetScaler ADC and Gateway were exploited in 2026. Update to 14.1-73.41 or 13.1-64.28 and end all sessions.

Published
Updated
Fixed in
March fixes 14.1-66.59, 13.1-62.23, 13.1-37.262 FIPS/NDcPP; June fixes 14.1-72.61, 13.1-63.18, 13.1-37.272 FIPS/NDcPP; latest builds 14.1-73.41 and 13.1-64.28
Exploitation
Yes. CVE-2026-3055 exploited from about 27 March 2026, in CISA KEV since 30 March; CVE-2026-8452 exploited after a 14 August PoC, in KEV since 26 August; CVE-2026-8451 not in KEV

Live scores

CVE-2026-3055
EPSS
0.915
very likely to be attacked soon
VEDAS
0.985
strong exploit evidence
On CISA KEV
Yes, since 2026-03-30
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
100.1CVE-2026-3055 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-3055 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-4368
EPSS
0.034
some chance of attack soon
VEDAS
0.065
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-8451
EPSS
0.005
low predicted chance of attack
VEDAS
0.976
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

Live scores

CVE-2026-8452
EPSS
0.010
some chance of attack soon
VEDAS
0.968
strong exploit evidence
On CISA KEV
Yes, since 2026-08-26
Detection rule
None yet
EPSS (chance of attack)
100.1Added to CISA KEV 2026-08-26CVE-2026-8452 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9Added to CISA KEV 2026-08-26CVE-2026-8452 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

VEDAS flagged this bug about 5 days before CISA confirmed attacks.

What happened

NetScaler ADC and Gateway had four related memory bugs in 2026, in two bulletins. Two were exploited.

23 March 2026: CVE-2026-3055 (“CitrixBleed 3”) and CVE-2026-4368 (CTX696300).

  • CVE-2026-3055, CVSS v4 9.3: an out-of-bounds read when the appliance is configured as a SAML identity provider (IdP). No authentication needed (CVE record). Picus describes two triggers: a POST /saml/login request that omits AssertionConsumerServiceURL, and a /wsfed/passive request with a valueless wctx parameter. Leaked memory comes back base64-encoded in the NSC_TASS cookie and can include session tokens, SAML assertions, LDAP credentials and internal IPs (Picus). Exploitation was seen from about 27 March, and CISA added it to KEV on 30 March with a due date of 2 April (Picus; CISA KEV; Horizon3.ai).
  • CVE-2026-4368, CVSS v4 7.7: a race condition that can mix up user sessions on Gateway or AAA virtual servers. It affects only build 14.1-66.54 (CVE record). No exploitation reported; not in KEV.

30 June 2026: CVE-2026-8451 and CVE-2026-8452 (CTX696604).

  • CVE-2026-8451, CVSS v4 8.8: another SAML IdP memory overread, which watchTowr found while studying the CVE-2026-3055 patch. A crafted <samlp:AuthnRequest> to /saml/login leaks a few dozen bytes per request in NSC_TASS, or crashes the packet engine (nsppe) (CVE record; Socura). It was not in KEV as of 30 October 2026, and we found no confirmed exploitation in the sources we opened.
  • CVE-2026-8452, CVSS v4 8.8: a memory overflow on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix called it denial of service (CVE record). On 14 August watchTowr published a write-up and working proof of concept showing unauthenticated code execution as root. Exploitation followed: Defused saw hits on its sensors, and Previdian reported web shells named x.php and z.php plus id and echo discovery commands from three IPs in three countries (Help Net Security). CISA added it to KEV on 26 August with a due date of 29 August. Shadowserver then tracked more than 22,000 NetScaler ADC and nearly 1,800 Gateway instances online (BleepingComputer).

The October follow-ups, CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779, are covered in our NetScaler CVE-2026-88779 advisory.

Am I affected?

CVEConditionFixed in
CVE-2026-3055SAML IdP configured14.1-66.59, 13.1-62.23, 13.1-37.262 (FIPS/NDcPP)
CVE-2026-4368Gateway or AAA vserver on 14.1-66.5414.1-66.59
CVE-2026-8451SAML IdP configured14.1-72.61 (also FIPS), 13.1-63.18, 13.1-37.272 (FIPS/NDcPP)
CVE-2026-8452Gateway or AAA vserver14.1-72.61 (also FIPS), 13.1-63.18, 13.1-37.272 (FIPS/NDcPP)

Sources: CVE records for CVE-2026-3055, CVE-2026-4368, CVE-2026-8451 and CVE-2026-8452. Citrix-managed cloud services are updated by Citrix.

From the NetScaler CLI (Picus; Socura):

show ns version
show runningConfig | grep "add authentication samlIdPProfile"
show runningConfig | grep -E "add (authentication|vpn) vserver"

Any samlIdPProfile line puts you in scope for CVE-2026-3055 and CVE-2026-8451. Any vpn vserver or authentication vserver line puts you in scope for CVE-2026-8452.

Signs of attacks:

  • Leaks (CVE-2026-3055, CVE-2026-8451): POST /saml/login with a decoded SAMLRequest that lacks AssertionConsumerServiceURL or has malformed attributes; /wsfed/passive?wctx with no value; bursts of GET /cgi/GetAuthMethods from outside; unusually large Set-Cookie: NSC_TASS headers; unexpected nsppe crashes (Picus; Socura).
  • Code execution (CVE-2026-8452): files named x.php or z.php, or any PHP file you did not put on the appliance (Help Net Security).
bash
# From the appliance shell
grep -E 'add authentication samlIdPProfile|add (vpn|authentication) vserver' /nsconfig/ns.conf
find / -name 'x.php' -o -name 'z.php' 2>/dev/null

What to do now

  1. Save logs, then update. Picus notes an upgrade may rotate ns.log, so copy logs off first (Picus). Then go to 14.1-73.41 or 13.1-64.28 (14.1-73.41 FIPS; 13.1-37.282 FIPS and NDcPP). These are the current fixed builds for October’s CVE-2026-88779 and include the March and June fixes (CVE-2026-88779 record).
  2. End every session after patching on any appliance that was an internet-facing SAML IdP while unpatched. Leaked session tokens survive the upgrade. Picus advises invalidating the NSC_AAAC, NSC_TMAS and NSC_TASS cookies and forcing all users to sign in again (Picus).
  3. Rotate what the IdP held in memory. Picus recommends rotating LDAP bind credentials, SAML signing keys and service-account passwords used by the appliance (Picus).
  4. Check Gateway and AAA appliances for web shells if they were unpatched after 14 August. If you find one, the attacker had root: rebuild the appliance rather than clean it.
  5. If you cannot patch at once, remove SAML IdP profiles from internet-facing appliances, restrict /saml/login and gateway endpoints with firewalls or allowlists, and add WAF rules for malformed SAMLRequest and wctx patterns (Socura; Picus).
  6. Hunt for session reuse: VPN logins, ICA Proxy and RDP Proxy sessions from unfamiliar IPs or at odd hours since March (Picus).

Why this matters

Each NetScaler patch in 2026 led researchers to the next bug. watchTowr found CVE-2026-8451 by reading the CVE-2026-3055 fix, and turned the “denial of service” CVE-2026-8452 into root code execution six weeks after the patch. Treat Citrix’s initial impact rating as a floor, not a ceiling.

Sources