CISA tells federal agencies to patch Citrix NetScaler bug by Thursday

Researchers and CISA warn that CVE-2026-3055, a critical (CVSS 9.3) vulnerability in Citrix NetScaler ADC / NetScaler Gateway, is being exploited in the wild; Citrix released a patch on March 23 and federal agencies were ordered to apply fixes urgently. The flaw permits unauthenticated actors to read sensitive memory and has similarities to past CitrixBleed vulnerabilities that were used by ransomware gangs and nation-state actors to gain initial access to enterprise environments.