➡️ CVE-2026-3055 👀 👇 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
-
️ CVE-2026-3055 
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300CVE-2026-3055 - Out-of-Bounds Read vulnerability - CVSSv4 base score: 9.3
Note: Citrix NetScaler ADC or Citrix Gateway must be configured as SAML IDP to be vulnerable to CVE-2026-3055.- CVE-2026-4368 - Race Condition vulnerability - CVSSv4 base score: 7.7Note: Affected appliances must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server to be vulnerable CVE-2026-4368.
-
️ CVE-2026-3055
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300CVE-2026-3055 - Out-of-Bounds Read vulnerability - CVSSv4 base score: 9.3
Note: Citrix NetScaler ADC or Citrix Gateway must be configured as SAML IDP to be vulnerable to CVE-2026-3055.- CVE-2026-4368 - Race Condition vulnerability - CVSSv4 base score: 7.7Note: Affected appliances must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server to be vulnerable CVE-2026-4368.
@decio Here we go again - CitrixBleed 3?
-
@decio Here we go again - CitrixBleed 3?
@christopherkunz Let’s hope not,🫣 but yeah, this smells bad. Some honeypot operators have reported a noticeable rise in attacks targeting these devices over the past week and watchtwr is sounding the horn.
If the wind carries the smell… -
️ CVE-2026-3055
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300CVE-2026-3055 - Out-of-Bounds Read vulnerability - CVSSv4 base score: 9.3
Note: Citrix NetScaler ADC or Citrix Gateway must be configured as SAML IDP to be vulnerable to CVE-2026-3055.- CVE-2026-4368 - Race Condition vulnerability - CVSSv4 base score: 7.7Note: Affected appliances must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server to be vulnerable CVE-2026-4368.
️ CVE-2026-3055 / Citrix NetScaler : la reconnaissance est en cours.Des activités de reconnaissance ciblent déjà les appliances exposées, avec notamment des requêtes vers /cgi/GetAuthMethods pour identifier les configs exploitables, en particulier les environnements SAML IdP.
GBHackers relaie ces observations
https://gbhackers.com/hackers-probe-citrix-netscaler-systems-cve-2026-3055-exploitation/Côté exposition, ONYPHE recense plus de 18000 IP uniques sur une version vulnérable, (dont environ +800 en Suisse).
https://www.linkedin.com/posts/onyphe_vulnerability-asm-attacksurfacemanagement-activity-7442250727046987776-ofYVLe pattern rappelle clairement les précédents CitrixBleed : si du NetScaler est encore exposé, la fenêtre avant exploitation de masse pourrait être très courte.
-
R relay@relay.infosec.exchange shared this topic
