Citrix Net Scaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug
Summary: Researchers at Defused Cyber and watchTowr are observing active reconnaissance against Citrix NetScaler ADC and NetScaler Gateway, with attackers probing the /cgi/GetAuthMethods endpoint to fingerprint authentication flows and determine whether appliances are configured as a SAML Identity Provider, a prerequisite for exploiting CVE-2026-3055 (CVSS 9.3), an insufficient input validation flaw leading to memory overread. Exploitation attempts have originated from known threat actor source IPs as of March 27, 2026, with attackers sending crafted SAMLRequest payloads to /saml/login that omit the AssertionConsumerServiceURL field and cause the appliance to leak memory contents via the NSC_TASS cookie; CISA has added the flaw to its KEV catalog with an April 2, 2026 remediation deadline for FCEB agencies.
What's compelling: CISA's April 2, 2026 deadline and watchTowr's observation of exploitation from known threat actor IPs as of March 27 leave a matter of days, not weeks, for organizations running affected NetScaler versions in SAML IDP configurations.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-4966CVE-2025-5777CVE-2025-6543CVE-2025-7775CVE-2026-3055
- Related
- CVE-2026-3055: Citrix Net Scaler Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Mar 30, 2026