Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/l0lsec/check-cve-2026-3055-netscaler
Vulnerability ScannersExploitationWeb SecurityNetwork Security
GitHubl0lsec/check-cve-2026-3055-netscaler

check-cve-2026-3055-netscaler

Low-impact probe for Citrix NetScaler CVE-2026-3055 (SAML IdP memory overread)

View Repository
14 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-3055 NetScaler SAML IdP check

Python helper to probe Citrix NetScaler / NetScaler Gateway appliances for CVE-2026-3055 (memory overread when acting as a SAML Identity Provider). Detection logic matches the public write-up from watchTowr Labs.

Prerequisites

  • Python 3.10+
  • Only applies to appliances configured as a SAML IdP. Gateways without that role typically return 404 on /saml/login; that means not applicable for this CVE, not “safe from all NetScaler issues.”

Install

root@kitploit:~
cd check-cve-2026-3055-netscaler
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

root@kitploit:~
python check_cve_2026_3055.py --targets https://netscaler.example.com https://10.0.0.1

Optional:

  • --timeout SECONDS — HTTP timeout (default: 10)

TLS certificate verification is disabled intentionally (common for lab/self-signed appliances).

How to read results

OutcomeMeaning
POTENTIALLY VULNERABLEResponse includes NSC_TASS cookie after the crafted POST (per watchTowr). Patch.
PATCHEDBody contains Parsing of presented Assertion failed (patched behavior in the article).
NOT APPLICABLENo cookie and no patched marker (often HTTP 404) — SAML IdP path not in use or different response shape.
UNREACHABLENetwork / timeout / connection error.

This is a low-impact active check (single POST to /saml/login plus a GET to /metadata/samlidp/). Use only on systems you are authorized to test.

References

  • watchTowr: Citrix NetScaler CVE-2026-3055 Memory Overread
  • Citrix advisory and patched builds: follow vendor guidance for your track (e.g. 14.1-66.59+, 13.1-62.23+, as described in the article).

License

Use at your own risk for authorized security assessment only.

Download Tool