CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks

Key Takeaways

• The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a critical vulnerability, CVE-2026-3055, affecting Citrix NetScaler products.
• This out-of-bounds read flaw, categorized as CWE-125, is actively being exploited in the wild, particularly when NetScaler appliances function as a SAML Identity Provider.
• Exploitation can lead to the exposure of sensitive memory data, including authentication tokens and user credentials, potentially granting remote attackers access to corporate networks.
• CISA has added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to remediate by April 2, 2026, and strongly advising all organizations to act immediately.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning concerning a severe vulnerability within Citrix NetScaler products. This flaw, officially designated CVE-2026-3055, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling confirmed active exploitation by threat actors.

Organizations utilizing affected Citrix NetScaler deployments are strongly advised to prioritize immediate action to mitigate potential security breaches. The vulnerability specifically impacts Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway), and the specialized NetScaler ADC FIPS and NDcPP models.

Citrix NetScaler Vulnerability Under Active Exploitation

The root cause of CVE-2026-3055 is an out-of-bounds read vulnerability, classified under CWE-125. This critical flaw manifests when the vulnerable appliances are configured to operate as a Security Assertion Markup Language (SAML) Identity Provider (IdP).

Exploiting this weakness enables a remote attacker to trigger a memory overread condition. This allows malicious actors to access sensitive information directly from the system’s memory. Given that the appliance acts as an authentication hub in this configuration, any memory exposure could compromise vital data such as authentication tokens, user credentials, or session data, potentially leading to unauthorized access to the wider corporate network.

CISA’s inclusion of CVE-2026-3055 in its KEV catalog underscores that this vulnerability is not merely theoretical but is actively being leveraged in real-world attacks. While CISA has not yet confirmed if this flaw is linked to ransomware campaigns, the active exploitation of any internet-facing edge gateway appliance presents a significant and immediate threat. Threat actors frequently target such authentication devices, like NetScaler, as a primary entry point into enterprise networks.

CISA has imposed an accelerated remediation timeline for this specific threat. Federal Civilian Executive Branch (FCEB) agencies are required to secure their vulnerable systems by April 2, 2026, in compliance with Binding Operational Directive (BOD) 22-01. Although the directive specifically targets federal entities, CISA strongly urges all private sector organizations to apply vendor mitigations promptly. In cases where patches or mitigations cannot be applied, or are unavailable for legacy systems, organizations should consider discontinuing the use of the product until it can be properly secured. Utilizing the KEV catalog as a primary input for vulnerability management remains a highly effective strategy for organizations to stay ahead of evolving threat landscapes.

What You Should Do

• Immediately identify if your organization uses Citrix NetScaler ADC, NetScaler Gateway, or NetScaler ADC FIPS/NDcPP models.
• Verify if these appliances are configured to operate as a SAML Identity Provider (IdP), as this is the specific configuration susceptible to CVE-2026-3055.
• Apply all available patches and security updates from Citrix without delay.
• If immediate patching is not feasible, implement recommended vendor mitigations to reduce exposure.
• As a last resort, if systems cannot be patched or secured, consider temporarily discontinuing the use of affected products until proper remediation can be applied.
• Monitor logs for any unusual activity or unauthorized access attempts related to your NetScaler appliances.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.