Filestore.Fortinet Critical Memory Overread Vulnerability in Citrix NetScaler Exploited
Article Content
- •CVE-2026-3055 is a critical memory overread vulnerability in Citrix NetScaler.
- •Over 2,000 daily exploitation attempts have been detected, primarily targeting SAML services.
- •Affected organizations must upgrade to patched versions to mitigate risks of credential exposure.
Citrix NetScaler ADC and Gateway are affected by CVE-2026-3055, a critical vulnerability due to insufficient input validation during SAML authentication, leading to memory overread. Exploitation attempts have surged, with FortiGuard reporting over 2,000 blocked attacks daily, primarily targeting SAML services in sectors like Technology and Government. The vulnerability has a CVSS score of 9.3 and was added to CISA's Known Exploited Vulnerabilities catalog on March 30, 2026. Organizations using affected systems are at risk of credential exposure and unauthorized access. Citrix has urged customers to upgrade to patched versions immediately. The vulnerability was publicly disclosed on March 3, 2026, with a proof of concept released shortly before. The ongoing exploitation highlights the urgency for remediation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Citrix and CVE-2026-3055 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation On September 26, 2026, security firm watchTowr reported two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances, allowing remote code execution (RCE) and actively exploited in the wild. Citrix has confirmed the existence of these vulnerabilities, tracked as CVE-2026-88771 and… 
Dutch Intelligence Warns of Chinese Malware Targeting Edge Devices Dutch intelligence agencies have reported a surge in Chinese cyberattacks targeting edge devices such as routers and firewalls. A newly discovered malware can survive firmware updates and has compromised 20,000 network appliances globally. The Military Intelligence and Security Service (MIVD) and the General…