In CISA KEV9.3 CriticalCWE-125
CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability
CitrixNetScaler
Status
- Exploited in the wild
- In CISA KEV since 30 Mar
- Vendor fix available
Federal deadlineThu 2 Apr, 23:59 UTC
Passed 205 days ago
CISA KEV · added 30 Mar
Exploit probabilityEPSSchecked 25 Oct
4.0%probability of exploitation in the next 30 days
Higher than 91% of scored CVEs
SeverityCVSS
9.3Critical
Description NVD
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 15 articles · 7 outlets
See the full timelineShow as table
- U.S. CISA adds a flaw in Citrix NetScaler to its Known Exploited Vulnerabilities catalogSecurity Affairs
- CISA Adds CVE-2026-3055 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- CISA Adds One Known Exploited Vulnerability to CatalogCISA · official notice
- CISA Adds CVE-2026-3055 to Known Exploited Vulnerabilities CatalogueCISA · official notice
- ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and MoreThe Hacker News
- Critical Citrix NetScaler Vulnerability Exploited in the WildInfosecurity
- Exploitation of Fresh Citrix NetScaler Vulnerability BeginsSecurityWeek
- Urgent Alert: NetScaler bug CVE-2026-3055 probed by attackers could leak sensitive dataSecurity Affairs
- Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread BugThe Hacker News
- Citrix Urges Immediate Patching for Critical NetScaler VulnerabilitiesInfosecurity
- CVE-2026-3055: NetScaler Memory Disclosure Puts SAML-Enabled Edge Devices at RiskSOCRadar
- Citrix NetScaler critical flaw could leak data, update nowSecurity Affairs
- Critical Citrix NetScaler Vulnerability Poised for Exploitation, Security Firms WarnSecurityWeek
- Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data LeaksThe Hacker News
- CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds ReadRapid7 · first in our coverage