Critical Citrix NetScaler Vulnerability Exploited in the Wild

A critical Citrix NetScaler ADC/Gateway vulnerability (CVE-2026-3055, CVSS v4.0 9.3) allows unauthenticated attackers to trigger an out-of-bounds read and leak appliance memory on systems configured as SAML Identity Providers; researchers observed in-the-wild exploitation from honeypots and fingerprinting activity beginning March 27. Citrix, security researchers and national agencies urge immediate patching to the listed firmware versions and offer a temporary Global Deny List mitigation for specific builds while upgrades are scheduled.