Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Citrix NetScaler “CitrixBleed 3” (CVE-2026-3055 / -4368) and CVE-2026-8451, Mar and Jun 2026
CVE-2026-3055: SAML-IdP out-of-bounds read.
- Disclosed
What happened
- CVE-2026-3055: SAML-IdP out-of-bounds read. Advisory CTX696300, 23 Mar 2026. Exploited from about 27 Mar. Sources disagree on the KEV date.
- CVE-2026-8451: SAML over-read, 30 Jun 2026. Exploited within about 24 hours of the watchTowr PoC.
- CVE-2026-88779 (DoS, about 4 Oct 2026) is in KEV per secondary sources (UNVERIFIED detail).
Live scores
Live scores
CVE-2026-3055- EPSS
- 0.915
very likely to be attacked soon - VEDAS
- 0.985
strong exploit evidence - On CISA KEV
- Yes, since 2026-03-30
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2026-4368- EPSS
- 0.034
some chance of attack soon - VEDAS
- 0.065
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-8451- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.976
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-88779- EPSS
- 0.114
likely to be attacked soon - VEDAS
- 0.536
some exploit evidence - On CISA KEV
- Yes, since 2026-10-04
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://horizon3.ai/attack-research/vulnerabilities/cve-2026-3055/
- https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread
- https://www.sophos.com/en-us/blog/citrix-netscaler-vulnerability-cve-2026-88779-in-active-exploitation
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.