Vulnerabilities & Exploits · Zero-Day Exploit

Citrix NetScaler Flaws Risk Memory Disclosure and Session Mix‑up

Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, CVE-2026-3055 and CVE-2026-4368. CVE-2026-3055 is an out-of-bounds read (CVSS 9.3) that can let unauthenticated attackers leak appliance memory when configured as a SAML Identity Provider. CVE-2026-4368 is a race condition (CVSS 7.7) that can cause user session mix-ups on Gateway or AAA virtual server configurations; fixes are in 14.1-66.59, 13.1-62.23 and 13.1-37.262.

10 sources · Mar 31

Timeline

• Apr 2 CISA federal deadline for CVE-2026-3055
• Mar 31 Reported by Cybersecurity Dive
• Mar 30 Reported by BleepingComputer
• Mar 28 Reported by The Hacker News
• Mar 25 Reported by CSO Online
• Mar 24 Reported by Help Net Security
• Mar 23 Reported by Rapid7

Sources

• Mar 31 Cybersecurity Dive

  Citrix NetScaler products confirmed to be under exploitation

  Security researchers at watchTowr warn that multiple flaws are involved in the early stages of a hacking spree that could rival the 2023 CitrixBleed campaign.

  original

• Mar 30 BleepingComputer

  Critical Citrix NetScaler memory flaw actively exploited in attacks

  Hackers are exploiting a critical severity vulnerability, tracked as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway appliances to obtain sensitive data.

  original

• Mar 30 Infosecurity Magazine

  Critical Citrix NetScaler Vulnerability Exploited in the Wild

  Researchers from watchTowr and Defused have found evidence that attackers are actively exploiting CVE-2026-3055, a critical NetScaler vulnerability

  original

Vendor digest: Citrix

Part of the PlainSec briefing for 2026-03-25

Every edition of this story: Citrix NetScaler Flaws Risk Memory Disclosure and Session Mix‑up

More from today

• Oracle Patches Critical Unauthenticated RCE in Fusion Middleware
• Chrome 146 Fixes Eight High‑Severity Memory Bugs
• Unauthenticated SharePoint RCE Added to CISA KEV