Critical Citrix NetScaler Flaw Draws Active Reconnaissance as Security Firms Warn of Imminent Exploitation
CVE-2026-3055, a CVSS 9.3 memory overread in NetScaler ADC and Gateway, echoes the 2023 CitrixBleed vulnerability that led to mass exploitation, with over 30,000 instances exposed online.
Overview
Citrix has released an emergency patch for CVE-2026-3055, a critical out-of-bounds memory read vulnerability affecting its NetScaler ADC and NetScaler Gateway appliances. Rated 9.3 on the CVSS v4.0 scale, the flaw allows unauthenticated remote attackers to extract sensitive information — including active session tokens — from device memory. Security researchers are already observing reconnaissance activity targeting the vulnerability, and multiple firms have warned that active exploitation is likely imminent.
With more than 30,000 NetScaler ADC instances and over 2,300 Gateway instances currently exposed on the internet according to Shadowserver tracking data cited by BleepingComputer, the window for defenders to act is narrowing rapidly.
What We Know
Cloud Software Group, the parent company of Citrix, published security advisory CTX696300 on March 23, 2026, disclosing two vulnerabilities in NetScaler ADC and NetScaler Gateway, as reported by BleepingComputer. The more severe of the two, CVE-2026-3055, stems from insufficient input validation that enables an out-of-bounds memory read. The flaw affects appliances configured as a SAML Identity Provider, a common enterprise configuration used to facilitate single sign-on across platforms such as Microsoft 365, Salesforce, and Workday. Default NetScaler configurations are not affected.
The affected versions span NetScaler ADC and Gateway 14.1 before 14.1-66.59, versions 13.1 before 13.1-62.23, and NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.262, according to Infosecurity Magazine. Cloud-managed Citrix instances are not affected.
A second vulnerability, CVE-2026-4368, was disclosed alongside it. Rated 7.7 (High) on the CVSS scale, it involves a race condition that can cause user session mix-ups, potentially exposing one user’s authenticated session to another. This flaw specifically affects build version 14.1-66.54 when configured as a Gateway or AAA virtual server, as reported by Infosecurity Magazine.
Citrix stated that both vulnerabilities were identified internally during ongoing security reviews. Fixed firmware version 14.1-66.59 was released on March 23, 2026. Organizations can also deploy Global Deny List signatures available in NetScaler builds 14.1.60.52 and later for immediate protection without a reboot, according to Infosecurity Magazine.
Active Reconnaissance
Although no public proof-of-concept exploit exists for CVE-2026-3055, threat intelligence firms have detected active reconnaissance targeting NetScaler appliances. Security firm watchTowr reported observing attackers probing the /cgi/GetAuthMethods endpoint with HTTP POST requests to enumerate enabled authentication flows on NetScaler instances, according to BleepingComputer. Defused Cyber independently confirmed similar fingerprinting activity detected on March 27, 2026.
watchTowr warned that “in-the-wild exploitation is likely imminent” and urged organizations to “patch immediately,” noting that “the window to respond will evaporate” once exploit code becomes available, as reported by BleepingComputer.
Organizations can determine whether they are running a vulnerable configuration by inspecting their NetScaler configuration files for the string add authentication samlIdPProfile.
The CitrixBleed Shadow
The urgency surrounding CVE-2026-3055 is amplified by its striking resemblance to CVE-2023-4966, known as CitrixBleed, another memory-leak vulnerability in NetScaler that was widely exploited in 2023 and led to breaches at major organizations. A subsequent variant, dubbed CitrixBleed2, was disclosed in 2025 and was flagged by CISA as actively exploited, according to BleepingComputer. All three vulnerabilities share a common attack pattern: exploiting memory-handling flaws in NetScaler to steal session tokens without authentication.
The pattern has established NetScaler as a high-value target for threat actors, and security researchers expect the patch for CVE-2026-3055 to be reverse-engineered quickly.
What We Don’t Know
Several key questions remain unanswered. It is unclear how many of the 30,000-plus exposed NetScaler instances are configured as SAML Identity Providers and therefore actually vulnerable. The reconnaissance activity detected by watchTowr and Defused Cyber has not been attributed to any specific threat group. Whether CVE-2026-3055 has already been exploited in targeted attacks — before the patch was released or since — remains unknown, as Citrix has only stated that the flaws were discovered internally.
CISA has not yet added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog, which could trigger mandatory patching deadlines for U.S. federal agencies.