Skip to content
skopnix

Actively exploited · CISA KEV · NVD published 2026-03-23

CVE-2026-3055

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

  1. First PoC
  2. 52 days →Metasploit

Signals

Exploited in the wild
Yesadded 2026-03-30 · due 2026-04-02. An observation, not a forecast.
EPSS · 30-day forecast
4%Chance of exploitation in the next 30 days, 90th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

7 known · links only

GitHub PoCs · by trust, then stars5

  1. fevar54/CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC ↗Trust ok 100

    PoC de CVE-2026-3055: memory overread en Citrix NetScaler ADC/Gateway para filtrar session IDs.

    ★ 1 · created 2026-03-31

  2. fevar54/CVE-2026-3055-Scanner---Herramienta-de-Detecci-n ↗Trust ok 100

    Scanner de CVE-2026-3055: detecta NetScaler ADC/Gateway vulnerables a memory overread. Reportes JSON/HTML/CSV.

    ★ 1 · created 2026-03-31

  3. l0lsec/check-cve-2026-3055-netscaler ↗Trust ok 100

    Low-impact probe for Citrix NetScaler CVE-2026-3055 (SAML IdP memory overread)

    ★ 1 · created 2026-04-01

  4. 0xBlackash/CVE-2026-3055 ↗Trust ok 100

    CVE-2026-3055

    ★ 0 · created 2026-03-29

  5. NetVanguard-cmd/CVE-2026-3055 ↗Trust ok 100

    ★ 0 · created 2026-04-19

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. Citrix ADC (NetScaler) CVE-2026-3055 Scanner ↗

    This module scans for a vulnerability that allows a remote, unauthenticated attacker to leak memory from a target Citrix ADC server configured as a SAML IdP. The leaked memory is then scanned for session cookies which can be hijacked if found.

    ruby · seen 2026-10-18

Nuclei1

  1. Citrix NetScaler SAML IDP - Memory Overread ↗

    NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP

    yaml · seen 2026-10-18

On the wire

1 dispatch
  1. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.