Exploitation of Fresh Citrix NetScaler Vulnerability Begins

Exploitation of Fresh Citrix NetScaler Vulnerability Begins reports that in-the-wild exploitation of a fresh critical-severity flaw, tracked as CVE-2026-3055 (CVSS 9.3), has started less than a week after public disclosure.

The vulnerability is described as an out-of-bounds read issue that could leak memory and potentially obtain authenticated administrative session IDs, with Citrix having released fixes for NetScaler ADC and Gateway versions before 14.1-60.58 and 13.1-62.23, or ADC FIPS and NDcPP versions before 13.1-37.262.

WatchTowr warned that threat actors would likely start exploiting it, and on Friday reported the first active reconnaissance attempts against vulnerable NetScaler instances, followed by Sunday’s disclosure that active exploitation had begun. According to WatchTowr, the exploitation resembles CitrixBleed2 and requires a specific parameter in a malicious request, but without a value. Evidence suggests in-the-wild exploitation began at least by 27 March.