Vulnerability intelligence
CVE-2026-3055
Citrix NetScaler Out-of-Bounds Read Vulnerability
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
CVSS Score
9.3
Critical
EPSS — Exploit Probability
84%
Riskier than 100% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
unknown
Federal deadline 2026-04-02
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-04-02.
2 articles across 2 outlets · first covered Mar 30, 2026 · latest Mar 31, 2026
Tracked incidents
Coverage timeline
-
U.S. CISA adds a flaw in Citrix NetScaler to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Mar 31, 2026
-
CISA Adds CVE-2026-3055 to Known Exploited Vulnerabilities Cataloguewww.cisa.gov · Mar 30, 2026