Threat Actors Exploit Citrix NetScaler CVE-2026-3055

Security researchers have confirmed that threat actors are actively exploiting a critical vulnerability in Citrix NetScaler application delivery and security appliances, just days after its public disclosure. The flaw, identified as CVE-2026-3055, allows unauthenticated attackers to extract sensitive information from affected systems and was first detailed by Citrix on March 23.

The vulnerability stems from insufficient input validation, resulting in a memory overread that can leak data such as authenticated administrative session identifiers. With a CVSS score of 9.3, it poses a high risk of enabling full compromise of vulnerable appliances. Exploitation requires the devices to be configured as SAML identity providers, a setup common in organizations using single sign-on for authentication. Default configurations and cloud-managed instances remain unaffected, according to Citrix's advisory. The issue impacts NetScaler ADC and NetScaler Gateway versions prior to 14.1-60.58 and 13.1-62.23, as well as FIPS and NDcPP variants before 13.1-37.262.

Researchers at watchTowr detected initial reconnaissance activity targeting vulnerable instances as early as March 27, followed by...