ACCORDING to CISA, the agency has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The entry is CVE-2026-3055, described as a Citrix NetScaler Out-of-Bounds Read Vulnerability. CISA notes that this type of flaw is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
The move aligns with Binding Operational Directive (BOD) 22-01, which established the KEV Catalog as a living list of CVEs that carry significant risk to the federal enterprise and requires agencies to remediate identified vulnerabilities by the due date. While BOD 22-01 applies to Federal Civilian Executive Branch agencies, CISA urges all organisations to prioritise timely remediation of KEV Catalog vulnerabilities as part of vulnerability management. The release date for the alert is 30 March 2026.