CitrixBleed 3: A New Critical NetScaler Memory Leak Is About to Be Exploited and History Says You Have Days, Not Weeks

The Story

On March 23, Citrix published a security bulletin for two vulnerabilities in NetScaler ADC and NetScaler Gateway. The more serious is CVE-2026-3055 (CVSS 9.3), an out-of-bounds read caused by insufficient input validation that allows unauthenticated remote attackers to read sensitive contents from appliance memory. The flaw is exploitable when the appliance is configured as a SAML Identity Provider (SAML IDP). Default configurations are not affected.

The SAML IDP requirement may sound like a limiting factor, but it is not. Rapid7 noted that SAML IDP configuration is "likely a very common configuration for organizations utilizing single sign-on." Any enterprise using NetScaler as an identity provider for federated authentication to SaaS applications, partner portals, or internal services is in scope.

The structural similarity to previous Citrix memory disclosure flaws is what has the security industry on alert. CitrixBleed (CVE-2023-4966) was disclosed in October 2023 and rapidly exploited at scale by ransomware groups and nation-state actors, including the LockBit operation that hit Boeing, ICBC, and law firm Allen and Overy. CitrixBleed2 (CVE-2025-5777) followed the same pattern, with China-linked Salt Typhoon exploiting it to breach a European telecom provider and install backdoors. Both flaws were memory read vulnerabilities in internet-facing NetScaler appliances. CVE-2026-3055 is the third entry in this series.

watchTowr CEO Benjamin Harris told The Hacker News that CVE-2026-3055 "sounds suspiciously similar to CitrixBleed and CitrixBleed2, which continue to represent a trauma event for many." He warned that "imminent exploitation is highly likely." Rapid7 staff researcher Ryan Emmons said that once exploit code becomes public, "exploitation in the wild is imminent." Arctic Wolf noted that "threat actors are likely to target it and attempt to reverse engineer the patches."

Citrix discovered the flaw internally during a proactive security review, which means no attacker had a head start this time. That is a meaningful improvement over CitrixBleed2, which was discovered in the wild. But the clock is now running. Patches are available. Attackers are reverse engineering them. The window between patch availability and exploitation has been shrinking with every major vulnerability disclosure this year.

The second vulnerability, CVE-2026-4368 (CVSS 7.7), is a race condition that causes user session mix-ups on appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. This means one user could end up in another user's authenticated session, a serious access control failure in environments handling remote access and identity workflows.

The Adversary Perspective

From a red team standpoint, NetScaler ADC and Gateway appliances are among the most valuable targets on any enterprise perimeter. They sit at the network edge, handle authentication traffic, broker remote access, and process SAML assertions that carry identity tokens for downstream applications. Compromising one gives an attacker a vantage point that is difficult to replicate from any other entry point.

Memory read vulnerabilities on these devices are uniquely dangerous. Unlike a typical information disclosure, a memory read on an authentication appliance can leak active session tokens, SAML assertions, and authentication cookies. An attacker who captures a valid session token can authenticate to any downstream service the token grants access to, without ever needing credentials. This was the exact exploitation pattern for CitrixBleed: attackers harvested session tokens from memory and used them to bypass MFA entirely.

The exploitation model is repeatable and well understood. This is not a novel attack class that requires new tooling. The attacker community has exploited two previous memory reads in the same product family using the same technique. Existing exploit frameworks, scanning tools, and post-exploitation workflows built for CitrixBleed and CitrixBleed2 will likely require minimal modification to target CVE-2026-3055. This dramatically reduces the time between patch reverse engineering and weaponized exploitation.

The target population is substantial. CyCognito's analysis found that industrials account for 22.6% of exposed NetScaler assets, followed by consumer discretionary at 14.1%. These are internet-facing appliances by design. Shodan and similar scanning services make them trivially discoverable. Once a working exploit exists, mass scanning and exploitation will follow within hours, just as it did with both predecessors.

Defensive Takeaways