Executive Summary
Analysis of recent patches reveals that CVE-2026-3055 encompasses at least two distinct memory overread vulnerabilities in Citrix NetScaler appliances. These vulnerabilities affect the /saml/login and /wsfed/passive?wctx endpoints when the appliance is configured as a SAML Identity Provider (IdP).
Technical investigation confirms that the flaw behaves similarly to 'CitrixBleed', where a specially crafted request with a missing value for the 'wctx' parameter triggers a disclosure of raw system memory. This leaked data is returned base64-encoded within the 'NSC_TASS' cookie and can contain highly sensitive artifacts such as session tokens, internal IP addresses, and administrative credentials.
In-the-wild exploitation was observed starting as early as March 27th, 2026. Given the ease of exploitation and the critical nature of the disclosed data, immediate patching of affected Citrix NetScaler and Cloud Gateway appliances is required to prevent full system compromise.