Critical Citrix NetScaler Vulnerability CVE-2026-3055 Actively Probed by Attackers

Key Takeaways

• A critical memory overread vulnerability, CVE-2026-3055, has been identified in Citrix NetScaler ADC and Gateway appliances.
• The flaw carries a CVSS score of 9.3 and allows unauthenticated attackers to extract sensitive data.
• Active reconnaissance campaigns are underway, with threat actors probing internet-facing NetScaler instances to identify vulnerable SAML Identity Provider (IdP) configurations.
• Patches are available, and immediate application is crucial to mitigate the risk of imminent exploitation.

Citrix NetScaler Vulnerability Under Active Attack Scrutiny

Cybersecurity researchers are sounding the alarm regarding a newly disclosed critical vulnerability within Citrix NetScaler ADC and Gateway appliances, warning that it is ripe for widespread exploitation. Threat intelligence firms watchTowr and Defused Cyber have independently observed active reconnaissance efforts targeting CVE-2026-3055, a severe memory overread vulnerability that could enable unauthenticated attackers to exfiltrate sensitive information.

Organizations utilizing affected Citrix deployments are strongly advised to deploy available patches without delay. Experts anticipate that the current reconnaissance phase will rapidly escalate into full-scale attack campaigns if systems remain unprotected. Telemetry from honeypot networks indicates that malicious actors are actively employing POST requests to probe NetScaler appliances, specifically seeking out vulnerable authentication configurations.

Anatomy of CVE-2026-3055

Assigned a CVSS score of 9.3, CVE-2026-3055 originates from inadequate input validation, leading to an out-of-bounds memory read condition within the appliance. This vulnerability specifically impacts NetScaler ADC or Gateway instances configured to function as a SAML Identity Provider (IdP). Given the common deployment of SAML IdP profiles in enterprise single sign-on (SSO) environments for integrating cloud services, the potential attack surface for this flaw is considerable.

The nature of this vulnerability bears unsettling similarities to past “CitrixBleed” exploits, as it offers attackers an unauthenticated method to read and leak sensitive memory contents from targeted enterprise systems. The flaw does not require any user interaction and can be triggered remotely by sending specially crafted network requests to the vulnerable SAML endpoint.

Active Reconnaissance and Targeting

Through its global Attacker Eye honeypot network, watchTowr has documented threat actors actively scanning internet-exposed NetScaler infrastructure to pinpoint vulnerable configurations. The current reconnaissance activity primarily focuses on programmatic fingerprinting of authentication methods. Telemetry shows attackers heavily targeting the /cgi/GetAuthMethods endpoint with HTTP POST requests. This allows them to systematically enumerate the enabled authentication flows on exposed instances.

This particular probing technique is directly linked to the environmental requirements for exploiting CVE-2026-3055. By analyzing responses from the /cgi/GetAuthMethods endpoint, attackers can accurately determine if a target NetScaler instance is configured as a SAML IdP, thereby confirming its susceptibility to the memory overread exploit without needing to launch a blind attack. This programmatic filtering enables attackers to efficiently compile highly targeted lists of vulnerable appliances, paving the way for impending mass exploitation campaigns.

The detection of such specific, configuration-aware fingerprinting indicates a high degree of attacker intent and technical capability. Security experts explicitly warn that the window between this specialized reconnaissance and widespread active exploitation is rapidly diminishing.

What You Should Do

• Immediate Patching: Administrators operating NetScaler instances configured as a SAML IdP must prioritize the immediate application of the latest Citrix security updates.
• Prioritize Security: Organizations are strongly advised to temporarily halt non-critical operational tasks to focus on deploying these critical security updates.
• Monitor for Anomalies: Implement enhanced monitoring for suspicious activity on NetScaler appliances, particularly around SAML IdP configurations and authentication endpoints.
• Review Configurations: Verify that NetScaler ADC and Gateway appliances are configured according to best practices and that unnecessary services or features are disabled.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.