Critical Citrix Vulnerability Exploited in the Wild

The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added Citrix vulnerability CVE-2026-3055 to its catalog of known exploited vulnerabilities. This critical flaw, with a severity score of 9.3/10, stems from insufficient input validation in NetScaler ADC and Gateway SAML IDP configurations. It enables memory overread, potentially allowing threat actors to access sensitive data or execute unauthorized actions.

Exploitation of this vulnerability has been observed in the wild since March 27th, according to cybersecurity firms. Approximately 30,000 NetScaler instances and over 2,000 Gateway instances are currently exposed online. Federal Civilian Executive Branch agencies are mandated to apply the necessary patches by April 2nd to mitigate the risk posed by this widespread threat.