CitrixBleed 3 — CVE-2026-3055

CVE-2026-3055 ("CitrixBleed 3") is a critical (CVSS 9.3) out-of-bounds memory read (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). An unauthenticated remote attacker sends a crafted SAML request that triggers a memory overread, leaking sensitive appliance memory — session tokens, cookies, and other authentication artifacts — back in the response. Captured tokens let the attacker replay a valid authenticated session (session hijacking), bypassing MFA, exactly as the original CitrixBleed (CVE-2023-4966) and CitrixBleed 2 (CVE-2025-5777) did.

Citrix patched on 2026-03-23/24. WatchTowr observed active reconnaissance within a week; CISA added it to KEV on 2026-03-31; a Metasploit module landed 2026-03-31; and Fortinet confirmed large-scale active exploitation against internet-facing SAML-IdP NetScaler appliances in early June 2026. Companion CVE-2026-4368 (CVSS 7.7, race condition in Gateway/AAA on build 14.1-66.54) is fixed in the same releases.

Defensive reality: the appliance itself is the leak surface and there are no published atomic IOCs (no attacker IPs, hashes, or domains). The disclosure happens inside encrypted TLS to the appliance, so EDR will not see the overread directly. The hunt is behavioral: it lives in NetScaler/AAA logs (anomalous SAML/AAA traffic, IdP-initiated logins with no matching user session) and — most importantly for Falcon — in the downstream blast radius: hijacked sessions landing on internal hosts from the NetScaler/VPN egress, impossible-travel and new-device authentications, and lateral movement that follows.

Defender priority: Patching alone does NOT evict an attacker who already stole a session token. After upgrading every SAML-IdP NetScaler, you MUST terminate all active sessions (kill aaa session -all, kill icaconnection -all, kill pcoipConnection -all) and force re-authentication — then hunt for sessions that originated before the kill from the appliance's egress.

IOC provenance note: No source published concrete atomic IOCs (IPs, hashes, domains, filenames). WatchTowr released detection scripts and described how IOCs "might look," but no attributable atomic indicators exist. This pack is deliberately behavioral / TTP-driven — no IOCs were invented to pad it.

The exploit is a single unauthenticated request; the damage is everything an attacker does with a stolen, fully-authenticated session. Falcon telemetry begins where the hijacked session touches the network and endpoints behind the gateway.

Hunt hypotheses (highest fidelity first)

Attack chain

No atomic IOCs (IPs, hashes, domains, filenames) have been published by any cited source for CVE-2026-3055. The indicators below are configuration / behavioral — the only honest, source-backed indicators for an in-appliance memory-disclosure bug. Atomic-IOC rows are intentionally omitted rather than fabricated.

The single most valuable enrichment for this hunt is a list of your NetScaler / VPN egress IP(s). Every CQL below that references egress uses the placeholder 10.20.30.40 — replace it with your appliance's internal source IP(s) before running.

Run these directly on the appliance and IdP — they cover the steps Falcon EDR cannot see.

On each NetScaler (CLI)

# Confirm exposure: is SAML IdP configured?
show authentication samlIdPProfile

# Confirm running build vs fixed (14.1-66.59 / 13.1-62.23 / 13.1-37.262 FIPS-NDcPP)
show version

# Review for unauthorized config changes / new local users
show ns runningConfig | grep -iE "samlIdPProfile|add system user|bind system"

# Inspect auth logs for SAML parse errors & anomalous source IPs
shell tail -n 5000 /var/log/ns.log | grep -iE "saml|aaad|assertion"

On the SAML SP / IdP (Entra ID / ADFS / Okta)

• Search federated sign-ins for IdP-initiated logins with no matching authentication request (token reuse).
• Flag sign-ins where the source IP is the NetScaler egress but the session shows impossible travel or a new/unmanaged device.
• Alert on MFA-satisfied sessions that never presented an MFA challenge (replayed post-MFA token).
• Review for new app-consent grants, new federation trusts, or new local appliance accounts after 2026-03-23.

Q1/Q2 are identity-correlation hunts best run as scheduled searches (they need the egress-IP enrichment), not endpoint IOAs. Q7 is the strongest Prevent candidate.

No atomic IOCs are published for CVE-2026-3055, so the Falcon IOC-Management block uses REPLACE_WITH_* placeholders — populate only from confirmed incident evidence. The behavioral, config-audit, and validation blocks are the operative content for this pack.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_ATTACKER_IP,detect,high,2026-09-25,CitrixBleed3 exploit source (confirm in incident),campaign:CitrixBleed3
ipv4,REPLACE_WITH_C2_IP,detect,high,2026-09-25,CitrixBleed3 post-hijack C2 (confirm in incident),campaign:CitrixBleed3
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-25,CitrixBleed3 C2 (confirm in incident),campaign:CitrixBleed3
sha256,REPLACE_WITH_TOOL_HASH,prevent,critical,2026-12-25,Post-exploit tooling (confirm in incident),campaign:CitrixBleed3
# NOTE: no atomic IOCs were published for CVE-2026-3055 — do NOT import blank rows.

# CitrixBleed3 (CVE-2026-3055) behavioral indicators
# 1. SAML/AAA logon from NetScaler egress IP + concurrent session for same user elsewhere
# 2. IdP-initiated login with no matching originating user authentication request
# 3. MFA-satisfied federated session that never presented an MFA challenge (replayed token)
# 4. Discovery command burst (nltest/dsquery/net/whoami) minutes after a gateway logon
# 5. New local/domain account or privileged group add shortly after a gateway-egress logon
# 6. SAML processing errors / SAML endpoint hits from unexpected source IP ranges (appliance log)

# Is this appliance exploitable, and is it patched?
show authentication samlIdPProfile          # any output = vulnerable config present
show version                                # need: 14.1-66.59+ / 13.1-62.23+ / 13.1-37.262+ (FIPS-NDcPP)
show ns runningConfig | grep -iE "add system user|bind system global"   # rogue local accounts
# Vulnerable if SAML IdP configured AND build below the fixed version.

# After upgrading EVERY SAML-IdP NetScaler to a fixed build:
kill aaa session -all          # invalidate all AAA sessions
kill icaconnection -all        # terminate ICA sessions
kill pcoipConnection -all      # terminate PCoIP sessions
# Then force re-auth and rotate any secrets that may have been in appliance memory.
# Patching WITHOUT this step does not evict an attacker holding a stolen token.

Playbook A — Patch & evict (NetScaler CLI)

# 1. Confirm exposure and current build
show authentication samlIdPProfile
show version

# 2. Upgrade to a fixed build (per Citrix upgrade procedure for your platform)
#    Target: 14.1-66.59+  |  13.1-62.23+  |  13.1-37.262+ (FIPS-NDcPP)

# 3. After upgrade — invalidate every session an attacker may already hold
kill aaa session -all
kill icaconnection -all
kill pcoipConnection -all

# 4. Force credential reset for any account that may have been hijacked,
#    and rotate appliance secrets (SAML signing certs, service-account creds).

Playbook B — Restrict SAML/management exposure (responder + ACL)

# Limit management-plane (NSIP) reachability to admin networks only
add ns acl restrict_mgmt DENY -destIP = <NSIP> -srcIP != 10.0.0.0-10.0.0.255 -priority 10
apply ns acls

# Drop malformed/oversized SAML POSTs at the responder layer (illustrative;
# validate the expression against your traffic before enforcing)
add responder action drop_bad_saml drop
add responder policy block_oversized_saml "HTTP.REQ.URL.CONTAINS(\"/saml\") && HTTP.REQ.CONTENT_LENGTH.GT(65536)" drop_bad_saml
bind responder global block_oversized_saml 100 END -type REQUEST

Playbook C — Identity-side response (IdP / Entra)

# Revoke refresh/session tokens for any user seen in Q1/Q2 from the gateway egress
# Entra example:
Revoke-MgUserSignInSession -UserId <upn>
# Require re-registration of MFA for affected users; review and remove
# any new app-consent grants, federation trusts, or appliance-local accounts
# created after 2026-03-23.

Known gap: The exploitation event itself (the SAML memory overread) is invisible to Falcon EDR — it occurs inside the appliance over TLS. Close this gap by forwarding NetScaler ns.log/AAA/syslog into NGSIEM and alerting on SAML parse errors and anomalous SAML-endpoint sources (Native Hunts, §7). Validation gates for all CQL are in §11.

Generated 2026-06-25 · HuntPack pipeline (web-hunter-v2 → threat-hunter-v2 → crowdstrike-logscale-v2 → alert-builder-v2 → threat-hardening-v2 → review-v2) · Defensive content only.