Citrix NetScaler ADC/Gateway Actively Exploited for Memory Flaw CVE-2026-3055
Summary
A critical memory vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-3055) is being actively exploited by threat actors to exfiltrate sensitive data including authenticated administrative session IDs. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by March 31, 2026.
Threat Analysis
CVE-2026-3055 is a critical out-of-bounds read vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Threat actors are actively exploiting this flaw to leak application memory, enabling them to obtain authenticated administrative session IDs and sensitive configuration data without valid credentials. The vulnerability requires no user interaction and can be exploited remotely over the network. Affected products include all supported versions of NetScaler ADC and NetScaler Gateway prior to the patched releases. CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) catalog on March 30, 2026, and issued a binding operational directive requiring all Federal Civilian Executive Branch agencies to apply patches by March 31, 2026. Organizations should immediately apply Citrix's security updates, restrict management interface access to trusted networks, and review logs for signs of unauthorized session access. Indicators of compromise include unusual administrative logins and unexpected configuration changes.