Detect Citrix NetScaler Out-of-Bounds Read (CVE-2026-3055) in Google Chronicle
Detects exploitation attempts targeting CVE-2026-3055, an out-of-bounds read vulnerability (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated remote attackers to read sensitive memory contents, potentially leading to information disclosure or enabling further attacks. Detection focuses on anomalous HTTP request patterns, NetScaler management plane access, and memory-related crash indicators.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_3055_netscaler_oob_read {
meta:
author = "df00tech"
description = "Detects CVE-2026-3055 exploitation attempts against Citrix NetScaler"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-3055"
events:
$e.metadata.event_type = "NETWORK_HTTP"
$e.target.url != ""
(
$e.target.url = /\/vpn\// or
$e.target.url = /\/citrix\// or
$e.target.url = /\/logon\// or
$e.target.url = /\/epa\//
)
(
$e.target.url = /\.\.\// or
$e.target.url = /%00/ or
$e.target.url = /%2e%2e/
)
$e.principal.ip = $src_ip
match:
$src_ip over 5m
outcome:
$request_count = count($e.metadata.id)
condition:
#e > 3
}Chronicle YARA-L rule detecting repeated anomalous HTTP requests to Citrix NetScaler paths with path traversal or null byte patterns, aggregated per source IP over 5-minute windows to identify CVE-2026-3055 exploitation campaigns.
Data Sources
Required Tables
False Positives & Tuning
- Security scanners with aggressive crawling configurations targeting NetScaler login endpoints
- Misconfigured reverse proxies double-encoding URLs before forwarding to NetScaler
- Penetration testing engagements with authorized scope including NetScaler appliances
- Threat intelligence platforms probing known CVE paths to verify patch status
Other platforms for CVE-2026-3055
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate CVE-2026-3055 OOB Read Probe via Malformed VPN Endpoint Request
Expected signal: NetScaler access logs showing requests to /vpn/ with URI length >600 characters and path traversal sequences. HTTP response codes 400, 404, or 500 depending on patch status. Network capture showing outbound TCP connection to NetScaler port 443 with anomalous URI in HTTP request.
- Test 2Null Byte Injection Against NetScaler Gateway Authentication Endpoint
Expected signal: 15 sequential POST requests to /cgi/login from single source IP within 15 seconds. Varying response sizes across requests if OOB read is triggerable. NetScaler AppFW violation logs for null byte detection if AppFW is enabled. Process monitoring showing nsppe or nsnetsvc CPU spikes.
- Test 3Response Size Anomaly Validation for OOB Memory Disclosure
Expected signal: Two HTTP requests from same source IP — one to /vpn/index.html (baseline) and one to /epa/ with encoded path traversal. If vulnerable, probe response will be larger than baseline or contain unexpected binary content. NetScaler logs show both requests with response sizes in bytes_out field.
Response Playbook
Triage
- Identify the source IP(s) and determine whether they are internal, known partner, or external/unknown. Cross-reference against threat intelligence feeds for known scanners or malicious actors.
- Review the specific URI paths and payloads in the requests. Confirm presence of path traversal (../), null bytes (%00), or oversized query strings exceeding 512 characters targeting NetScaler VPN/gateway endpoints.
- Check NetScaler appliance logs and NSLOG for corresponding entries. Look for SIGSEGV, core dump indicators, or unusual process restarts in /var/log/ns.log or /var/nslog/ that may indicate memory corruption from OOB read.
- Determine the patch level of the affected NetScaler appliance. Confirm whether the CTX696300 security bulletin patch has been applied. Run 'show version' on the NetScaler CLI to obtain the firmware version.
- Assess whether any responses from the NetScaler during the suspicious request window contained unexpected data lengths or HTTP 500 errors that could indicate successful memory leakage.
Containment
- If exploitation is confirmed or strongly suspected, immediately block the offending source IP(s) at the perimeter firewall and on the NetScaler appliance using 'add policy expression' or IP reputation-based ACLs.
- Enable NetScaler Application Firewall (AppFW) with a strict security profile to filter malformed requests. Apply a virtual server-level WAF policy blocking path traversal and null byte patterns as an emergency measure while patching is coordinated.
- Isolate the affected NetScaler appliance from production traffic if evidence of memory disclosure exists. Redirect traffic to a standby HA peer or backup gateway to preserve forensic state of the primary.
- Revoke and rotate any session tokens, SSL certificates, or credentials that may have been exposed through memory leakage. Prioritize service accounts with access to backend resources reachable through the NetScaler.
Evidence Collection
- Collect NetScaler system logs from /var/log/ns.log, /var/nslog/, and /var/crash/ directories. Capture core dump files if present — these may contain memory fragments readable by the attacker and are critical forensic artifacts.
- Export NetScaler access logs (HTTPREQ/HTTPRESP log formats) for the relevant time window covering all requests to /vpn/, /citrix/, /logon/, and /epa/ paths. Include full URI, source IP, response code, and response size.
- Capture network packet captures (pcap) from the NetScaler management interface and data plane if available. Focus on sessions from identified source IPs to reconstruct the complete HTTP exchange including response payloads.
- Collect the NetScaler running configuration ('show running config') and version information ('show version', 'show hardware') for vulnerability assessment and patch gap analysis.
Escalation Criteria
- !Escalate immediately to incident response if network captures or response log analysis reveals that HTTP responses during the attack window contained anomalous payload sizes or binary data inconsistent with normal NetScaler responses, indicating potential memory disclosure.
- !Escalate if the attacker source IP is observed pivoting to internal resources via the NetScaler gateway session — indicating exploitation may have yielded credentials or session tokens enabling authenticated access to protected backend systems.
- !Escalate if multiple NetScaler appliances across different network segments show simultaneous anomalous request patterns from the same source, indicating a coordinated exploitation campaign rather than opportunistic scanning.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
NetScaler core dump files in /var/crash/ — contain memory snapshots that may reveal what data was accessible at time of OOB read - >
NetScaler HTTPREQ/HTTPRESP logs showing request URI, source IP, response code, and critically response Content-Length for anomaly detection - >
NetScaler ns.log entries for process crashes, restarts, or watchdog triggers (nsnetsvc, nsppe) correlating with attack timestamps - >
Network pcap files capturing the full TCP stream of suspicious HTTP sessions including response payloads - >
NetScaler audit log (/var/nslog/audit.log) for any configuration changes made during or after the attack window - >
System memory artifacts if forensic image was captured: look for strings from NetScaler process heap in unexpected HTTP response payloads
Tuning Guidance
Start with a 7-day lookback and tune the request_count threshold based on your environment's baseline NetScaler traffic volume. Environments with high-traffic VPN gateways serving thousands of concurrent users may need thresholds above 100 requests per 5-minute window. Whitelist known vulnerability scanners (Qualys, Tenable) by source IP. The most reliable signal is anomalous HTTP response sizes from NetScaler endpoints — tune the response size anomaly hunt query using a 30-day baseline before enabling as an alert. If NetScaler AppFW is deployed, its violation logs provide higher-fidelity signals than raw HTTP access logs and should be prioritized as the primary data source. Reduce false positives by scoping detections to specific NetScaler appliance hostnames or management network segments rather than broad network ranges.
Hunting Queries
Threat hunt for anomalously large HTTP responses from NetScaler endpoints, which may indicate successful out-of-bounds memory reads returning more data than expected for the requested resource. A response significantly larger than baseline for the same URI path is a key OOB read indicator.
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor == "Citrix" or Computer has_any ("netscaler", "citrix")
| where RequestURL has_any ("/vpn/", "/citrix/", "/logon/", "/epa/")
| extend ResponseSize = toint(AdditionalExtensions)
| where ResponseSize > 10000 and RequestMethod in ("GET", "OPTIONS")
| summarize MaxResponse = max(ResponseSize), AvgResponse = avg(ResponseSize), RequestCount = count() by SourceIP, RequestURL
| where MaxResponse > avg(ResponseSize) * 5
| project SourceIP, RequestURL, RequestCount, AvgResponse, MaxResponse
| order by MaxResponse descindex=citrix OR index=netscaler OR index=proxy sourcetype=citrix:netscaler:syslog
| where (uri_path LIKE "/vpn/%" OR uri_path LIKE "/citrix/%" OR uri_path LIKE "/logon/%")
| eval resp_size=tonumber(bytes_out)
| stats avg(resp_size) as avg_resp, max(resp_size) as max_resp, count as req_count by src_ip, uri_path
| eval anomaly_ratio=max_resp/avg_resp
| where anomaly_ratio > 5 AND req_count > 3
| sort -anomaly_ratio
| table src_ip, uri_path, req_count, avg_resp, max_resp, anomaly_ratioHunt for spikes in HTTP 400/500 errors on NetScaler VPN and EPA endpoints, which may indicate instability caused by OOB read exploitation triggering exception handling or process crashes in the NetScaler data plane.
W3CIISLog
| where TimeGenerated >= ago(30d)
| where csHost has_any ("netscaler", "citrix", "gateway") or csUriStem has_any ("/vpn/", "/epa/")
| where sc-status in (500, 502, 400)
| summarize ErrorCount = count(), UniqueURIs = dcount(csUriStem), Sources = dcount(cIP) by bin(TimeGenerated, 1h)
| where ErrorCount > 20
| order by ErrorCount descindex=netscaler OR index=citrix sourcetype=citrix:netscaler:syslog
| where (http_status IN ("500", "502", "400")) AND (uri_path LIKE "/vpn/%" OR uri_path LIKE "/epa/%")
| timechart span=1h count as error_count dc(src_ip) as unique_sources
| where error_count > 20Atomic Red Team Tests
Sends a crafted HTTP GET request to a Citrix NetScaler VPN endpoint with an oversized and malformed URI containing path traversal sequences to simulate the initial probe phase of CVE-2026-3055 exploitation. Lab environment only.
Command
curl -k -v --max-time 10 -H 'User-Agent: Mozilla/5.0' -H 'Accept: */*' "https://TARGET_NETSCALER_IP/vpn/../../../etc/passwd%00" 2>&1 | tee /tmp/cve_2026_3055_probe.log; curl -k -v --max-time 10 -H 'User-Agent: Mozilla/5.0' "https://TARGET_NETSCALER_IP/vpn/$(python3 -c 'print("A"*600)')" 2>&1 | tee -a /tmp/cve_2026_3055_probe.logCleanup
rm -f /tmp/cve_2026_3055_probe.logExpected Telemetry
NetScaler access logs showing requests to /vpn/ with URI length >600 characters and path traversal sequences. HTTP response codes 400, 404, or 500 depending on patch status. Network capture showing outbound TCP connection to NetScaler port 443 with anomalous URI in HTTP request.
Expected Detection
KQL/SPL detection triggers on request_count > 1 from same source IP to /vpn/ path with URI length > 512 characters. Chronicle YARA-L rule matches on path traversal pattern in target.url field.
Sends HTTP POST requests with null byte sequences to the NetScaler Gateway logon endpoint to test for OOB read conditions in string handling routines. Simulates the injection phase of CVE-2026-3055 exploitation.
Command
for i in $(seq 1 15); do curl -k -s -o /tmp/response_$i.bin -w "%{http_code} %{size_download}\n" --max-time 5 -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data "login=$(python3 -c 'print("user%00" + "A"*256)')&passwd=test&dummy=$(python3 -c 'print("B"*256)')" "https://TARGET_NETSCALER_IP/cgi/login" 2>&1; sleep 1; done | tee /tmp/cve_2026_3055_null_probe.logCleanup
rm -f /tmp/response_*.bin /tmp/cve_2026_3055_null_probe.logExpected Telemetry
15 sequential POST requests to /cgi/login from single source IP within 15 seconds. Varying response sizes across requests if OOB read is triggerable. NetScaler AppFW violation logs for null byte detection if AppFW is enabled. Process monitoring showing nsppe or nsnetsvc CPU spikes.
Expected Detection
Splunk detection triggers on request_count > 5 from src_ip to /cgi/login with %00 in uri_path. QRadar AQL query matches on URL LIKE '%00%' combined with POST method count > 3. CrowdStrike CQL detects repeated network connections with null byte URI pattern.
Sends baseline and probe requests to NetScaler EPA and VPN endpoints to compare response sizes. A significantly larger response to a crafted request compared to a normal request baseline may indicate memory disclosure via OOB read.
Command
echo '=== Baseline Request ===' > /tmp/oob_size_test.log; curl -k -s -o /dev/null -w "Response size: %{size_download} bytes, HTTP: %{http_code}\n" "https://TARGET_NETSCALER_IP/vpn/index.html" >> /tmp/oob_size_test.log; echo '=== Probe Request with Large Buffer ===' >> /tmp/oob_size_test.log; curl -k -s -o /tmp/probe_response.bin -w "Response size: %{size_download} bytes, HTTP: %{http_code}\n" -H "X-Forwarded-For: $(python3 -c 'print("1.2.3.4" + " "*200 + "5.6.7.8')")" "https://TARGET_NETSCALER_IP/epa/$(python3 -c 'print("%2e%2e/"*10 + "vpn/index.html")')" >> /tmp/oob_size_test.log; cat /tmp/oob_size_test.log; echo '=== Response Hex Dump (first 256 bytes) ==='; xxd /tmp/probe_response.bin | head -16Cleanup
rm -f /tmp/oob_size_test.log /tmp/probe_response.binExpected Telemetry
Two HTTP requests from same source IP — one to /vpn/index.html (baseline) and one to /epa/ with encoded path traversal. If vulnerable, probe response will be larger than baseline or contain unexpected binary content. NetScaler logs show both requests with response sizes in bytes_out field.
Expected Detection
Threat hunting query for response size anomaly detects MaxResponse > 5x AvgResponse for same URI pattern. Elastic EQL sequence rule triggers on request to /epa/ path followed by 4xx/5xx response from same IP pair. Sumo Logic query flags unique_paths > 2 with request_count > 3 from single source.