CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks

CISA has alerted organizations to CVE-2026-3055, a critical out-of-bounds read vulnerability in Citrix NetScaler ADC/Gateway appliances when configured as a SAML Identity Provider; active exploitation has been confirmed and the flaw is listed in CISA’s KEV catalog. The vulnerability can expose authentication tokens and credentials, enabling attackers to gain footholds in enterprise networks; CISA requires federal agencies to remediate by April 2, 2026 and urges all organizations to apply vendor mitigations or discontinue affected devices until secured.