Critical memory overread vulnerability in NetScaler ADC and Gateway when configured as SAML IDP. Actively exploited in the wild with CISA KEV listing, directly exploitable over the network without authentication.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: DIRECT_NETWORK
CVE Published: 2026-03-23
Added to CISA KEV: 2026-03-30 7 DAYS BETWEEN CVE AND KEV
By adding CVE-2026-3055 to the KEV catalog, CISA confirms that threat actors are actively leveraging this vulnerability in real-world attacks. While the agency notes that it is currently unknown if the flaw is being utilized in ransomware campaigns, the active exploitation of any edge gateway appliance remains a severe threat. Threat actors frequently target internet-facing authentication devices like NetScaler to establish an initial foothold into enterprise networks. CISA has mandated a highly accelerated remediation timeline for this specific threat.
Spread the loveIn a concerning development for the cybersecurity landscape, a critical vulnerability affecting Citrix NetScaler ADC and Gateway, identified as CVE-2026-3055, has been under active exploitation since March 27, 2026. This flaw, rated with a CVSS score of 9.3, poses significant risks to organizations using these Citrix products, particularly when configured as a SAML Identity ...
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.How to use the KEV ...
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-3055 weaknesses.EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
On March 23, 2026, Citrix published a security advisory for a critical vulnerability affecting their NetScaler ADC and NetScaler Gateway ...