NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Citrix NetScaler memory disclosure flaw CVE-2026-3055 used in attacks; fixes available

Attackers exploited CVE-2026-3055 to read sensitive memory from NetScaler appliances providing SAML sign-in. Supported branches have fixes. Ask your organisation's IT provider to update affected appliances and investigate possible compromise.

What to do

If your workplace or family office uses NetScaler, ask its IT provider to install a current supported release containing the fixes: 14.1-66.59, 13.1-62.23 or FIPS/NDcPP 13.1-37.262; Citrix also lists 14.1-60.58 as fixed. Ask them to investigate suspected compromise and revoke exposed access or credentials, rather than relying on an update alone.

What’s happening

CVE-2026-3055 lets an attacker without a login read sensitive information from memory on customer-managed Citrix NetScaler ADC and Gateway appliances configured to provide SAML sign-in. Citrix disclosed it on 23 March; Canada's Cyber Centre cited exploitation from 27 March, and CISA listed it as exploited on 30 March. This is a memory disclosure flaw, rather than the memory corruption described in the initial brief. Citrix provides fixes for every affected supported branch, including a separate 14.1-60.58 build confirmed in its revised bulletin. Citrix-managed cloud services were updated by the provider. As at 3 November, the reviewed reporting establishes neither a victim count nor that attacks have stopped.

What
Flaw
Affects
Citrix NetScaler ADC and NetScaler Gateway
Affected
Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-60.58, configured as a SAML identity provider
Customer-managed NetScaler ADC and NetScaler Gateway 13.1 before 13.1-62.23, configured as a SAML identity provider
Customer-managed NetScaler ADC FIPS and NDcPP before 13.1-37.262, configured as a SAML identity provider
Fixed in
NetScaler ADC and NetScaler Gateway 14.1-60.58
NetScaler ADC and NetScaler Gateway 14.1-66.59 and later releases
NetScaler ADC and NetScaler Gateway 13.1-62.23 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.262 and later releases of those branches
CVE
CVE-2026-3055
Since
23 Mar 2026
Closed
31 Mar 2026

Timeline

  1. Update

    BleepingComputer reported that CISA required US federal civilian agencies to secure affected appliances by 2 April. The number of vulnerable or compromised appliances remained unknown.

  2. CISA added

    CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities catalogue.

  3. Wider attacks

    Exploitation was observed from this date, according to research subsequently cited by Canada's Cyber Centre.

  4. Vendor revised

    Citrix revised its affected-version guidance and confirmed that 14.1-60.58 also fixes the flaw, alongside 14.1-66.59.

  5. Made publicFixed

    Citrix disclosed CVE-2026-3055 and published fixed releases. The flaw affects appliances configured as SAML identity providers.

Sources

  1. NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368Citrix · 23 Mar 2026
  2. AL26-006 — Vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway — CVE-2026-3055Canadian Centre for Cyber Security · 30 Mar 2026
  3. Citrix security advisory (AV26-267) — Update 1Canadian Centre for Cyber Security · 30 Mar 2026
  4. Critical Citrix NetScaler memory flaw actively exploited in attacksBleepingComputer · 30 Mar 2026
  5. CISA orders feds to patch actively exploited Citrix flaw by ThursdayBleepingComputer · 31 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS