Hackers Probe Citrix NetScaler Instances Ahead of Likely CVE-2026-3055 Exploitation

Cybersecurity researchers are sounding the alarm over imminent in-the-wild exploitation of a recently disclosed critical vulnerability in Citrix NetScaler ADC and Gateway appliances.

Threat intelligence firm watchTowr and Defused Cyber have detected active reconnaissance campaigns specifically targeting CVE-2026-3055, a high-severity memory overread flaw that could allow unauthenticated attackers to extract sensitive data.

Organizations relying on affected Citrix instances are urged to apply patches immediately before the reconnaissance phase transitions into full-scale attack campaigns.

Telemetry captured from honeypot networks shows threat actors actively utilizing POST requests to probe NetScaler appliances and uncover vulnerable authentication setups.

Citrix NetScaler Vulnerability

Assigned a CVSS score of 9.3, CVE-2026-3055 stems from insufficient input validation that leads to an out-of-bounds memory read condition within the…