Exploiting the Vulnerability: The Danger of the Critical Citrix NetScaler Memory Flaw

Hackers Exploiting Critical Vulnerability in Citrix NetScaler ADC and Gateway Appliances

Recently, hackers have been taking advantage of a critical vulnerability, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway appliances to access sensitive data. This vulnerability was first disclosed by Citrix in a security bulletin on March 23, alongside another high-severity flaw known as CVE-2026-4368. The affected versions of these products are those older than 14.1-60.58, 13.1-62.23, and 13.1-37.262.

Citrix specified that the vulnerability only impacts appliances configured as a SAML identity provider (IDP) and emphasized that action is necessary for on-premise appliance administrators.

Several cybersecurity firms have flagged CVE-2026-3055 as a significant risk due to its similarities with the previously exploited ‘CitrixBleed’ and ‘CitrixBleed2’ vulnerabilities from 2023 and 2025, respectively.

watchTowr, a company offering adversarial simulation and continuous testing services, reported observing reconnaissance activities targeting vulnerable instances. They warned of imminent exploitation, which was confirmed the next day when threat actors began exploiting the flaw to extract authentication administration session IDs, potentially enabling complete takeover of NetScaler appliances.

watchTowr’s analysis revealed that CVE-2026-3055 involves at least two distinct memory overread bugs affecting different endpoints handling SAML and WS-Federation passive authentication.

The researchers demonstrated that the security flaw could expose sensitive information, including authenticated administrative session IDs.

The researchers criticized Citrix for incomplete disclosure of the security issue in the bulletin, labeling it as “disingenuous.” They also shared a Python script to help identify vulnerable hosts.

As of now, Citrix’s bulletin does not acknowledge the exploitation of CVE-2026-3055. BleepingComputer reached out to the company for a response regarding the reported threat actor activity but has not received a reply.

As of March 28, The ShadowServer Foundation identified 29,000 NetScaler and 2,250 Gateway instances exposed online, although the percentage vulnerable to CVE-2026-3055 remains uncertain.