Hackers Scan Citrix NetScaler Systems Ahead of Suspected CVE-2026-3055 Exploitation

Cybersecurity researchers are sounding the alarm over imminent in-the-wild exploitation of a recently disclosed critical vulnerability in Citrix NetScaler ADC and Gateway appliances.

Threat intelligence firm watchTowr and Defused Cyber have detected active reconnaissance campaigns specifically targeting CVE-2026-3055, a high-severity memory overread flaw that could allow unauthenticated attackers to extract sensitive data from enterprise identity infrastructure.

A Critical Flaw at the Identity Edge

Assigned a CVSS score of 9.3, CVE-2026-3055 stems from insufficient input validation that leads to an out-of-bounds memory read condition within the appliance.

Citrix disclosed the flaw on March 23, 2026, and classified it as critical under CWE-125 (Out-of-Bounds Read).

To be vulnerable, the NetScaler ADC or Gateway must be explicitly configured to operate as a SAML Identity Provider (SAML IdP).

Because this identity federation profile is commonly deployed in…