Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug

This article covers CVE-2026-3055, a critical memory overread vulnerability (CVSS 9.3) in Citrix NetScaler ADC and Gateway that is under active reconnaissance and exploitation.

• •The flaw stems from insufficient input validation and allows attackers to leak sensitive memory contents via the NSC_TASS cookie.
• •Exploitation requires the appliance to be configured as a SAML Identity Provider (SAML IDP); attackers probe /cgi/GetAuthMethods to fingerprint auth methods.
• •Two distinct endpoints are affected: /saml/login and /wsfed/passive?wctx, with the wsfed variant triggered by a valueless 'wctx' query parameter.
• •Affected versions include NetScaler ADC/Gateway before 14.1-60.58, 14.1-66.59, and 13.1-62.23, as well as FIPS/NDcPP variants before 13.1-37.262.
• •