Citrix NetScaler memory overread flaw exploited days after patch, Cyber Centre warns

The Canadian Centre for Cyber Security warned on March 30, 2026, that a critical flaw in Citrix NetScaler ADC and NetScaler Gateway was being exploited, one week after Citrix released a fix. The bug, CVE-2026-3055, lets a remote, unauthenticated attacker read sensitive data from the appliance's memory.

The flaw drew immediate comparisons to CitrixBleed in 2023 and CitrixBleed 2 in 2025, two NetScaler memory leaks that were widely abused to hijack sessions. NetScaler appliances often serve as the front door for remote workers, so stolen session data can let an intruder skip passwords and multi-factor prompts.

What happened

Citrix disclosed CVE-2026-3055 alongside a second flaw, CVE-2026-4368, in a security bulletin on March 23. It described an insufficient input validation problem that leads to a memory overread. Only appliances configured as a SAML identity provider are affected. NVD rates it 9.8, and Citrix scored it 9.3 under CVSS 4.0.

Researchers at watchTowr reported reconnaissance and then in-the-wild exploitation starting around March 27. BleepingComputer reported that watchTowr found the leaked memory could include authenticated administrative session IDs, which could enable full takeover of an appliance. The Shadowserver Foundation counted about 29,000 NetScaler instances online at the time, though not how many were vulnerable.

The Cyber Centre's alert AL26-006 cited the same reporting. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on March 30.

Who is affected

Researchers said the bug was distinct from, but similar in effect to, the earlier CitrixBleed flaws. watchTowr also published a script to help defenders identify vulnerable hosts. Citrix's original bulletin did not mention exploitation.

The alert applies only to customer-managed appliances. Citrix said it had already updated Citrix-managed cloud services and Adaptive Authentication instances.

What to do

• Upgrade to NetScaler ADC and Gateway 14.1-60.58 or later, or 13.1-62.23 or later. FIPS and NDcPP builds need 13.1-37.262 or later.
• Check whether your appliance is configured as a SAML identity provider and prioritize those units.
• If you suspect compromise, follow Citrix's guidance: preserve evidence, isolate the appliance, revoke credentials and sessions, review connected systems, then rebuild and rotate secrets.
• Report suspicious activity to the Cyber Centre through My Cyber Portal.