ET WEB_SPECIFIC_APPS Citrix Netscaler SAML IDP Memory Overread (CVE-2026-3055) M2
Sourceet/open
CreatedApril 8, 2026
UpdatedApril 8, 2026
Classificationweb-application-attack
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix Netscaler SAML IDP Memory Overread (CVE-2026-3055) M2"; flow:established,to_server; flowbits:set,ET.Citrix_NS.CVE_2026_3055; http.uri; bsize:19; content:"/wsfed/passive?wctx"; fast_pattern; http.method; content:"GET"; reference:url,labs.watchtowr.com/please-we-beg-just-one-weekend-free-of-appliances-citrix-netscaler-cve-2026-3055-memory-overread-part-2/; reference:cve,2026-3055; classtype:web-application-attack; sid:2068632; rev:1; metadata:affected_product Citrix, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2026_04_08, cve CVE_2026_3055, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2026_04_08; target:dest_ip;)
References
Metadata
affected productCitrix
attack targetNetworking_Equipment
tls stateTLSDecrypt
created at2026_04_08
deploymentInternal
confidenceHigh
signature severityMajor
updated at2026_04_08
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!