Critical Memory Overread Vulnerability in Citrix NetScaler Exploited

Citrix NetScaler ADC and Gateway are affected by CVE-2026-3055, a critical vulnerability due to insufficient input validation during SAML authentication, leading to memory overread. Exploitation attempts have surged, with FortiGuard reporting over 2,000 blocked attacks daily, primarily targeting SAML services in sectors like Technology and Government. The vulnerability has a CVSS score of 9.3 and was added to CISA's Known Exploited Vulnerabilities catalog on March 30, 2026. Organizations using affected systems are at risk of credential exposure and unauthorized access. Citrix has urged customers to upgrade to patched versions immediately. The vulnerability was publicly disclosed on March 3, 2026, with a proof of concept released shortly before. The ongoing exploitation highlights the urgency for remediation.

Key Points: • CVE-2026-3055 is a critical memory overread vulnerability in Citrix NetScaler. • Over 2,000 daily exploitation attempts have been detected, primarily targeting SAML services. • Affected organizations must upgrade to patched versions to mitigate risks of credential exposure.