Loading story…
Citrix disclosed critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway, prompting alerts from both the Canadian Centre for Cyber Security and CERT-EU. The issues are tracked as CVE-2026-3055 and CVE-2026-4368, and impact multiple supported release branches, including 14.1, 13.1, and 13.1 FIPS/NDcPP versions running below the vendor’s fixed builds. Affected deployments include standard NetScaler ADC, NetScaler Gateway, and hardened FIPS/NDcPP editions.
Government cyber authorities urged organizations to review Citrix’s security bulletin and apply the recommended updates and mitigations without delay. The coordinated advisories indicate broad concern across enterprise and public-sector environments that rely on Citrix application delivery and remote access infrastructure, with administrators advised to identify exposed appliances and move vulnerable systems to patched versions listed by Citrix.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-31, JPCERT/CC issued an alert on Citrix NetScaler vulnerabilities CVE-2026-3055 and CVE-2026-4368, emphasizing that CVE-2026-3055 had already been observed and technically analyzed by overseas researchers. The advisory urged organizations to upgrade because no workaround was available and recommended reviewing logs for suspicious access to SAML and WSFed endpoints and anomalous DEBUG log strings that could indicate exploitation attempts.
On 2026-03-30, CISA added Citrix NetScaler flaw CVE-2026-3055 to its Known Exploited Vulnerabilities catalog after determining there was evidence of active exploitation. CISA said federal civilian agencies must remediate the issue under Binding Operational Directive 22-01 and urged all organizations to prioritize patching.
On 2026-03-30, the UK National Cyber Security Centre urged organizations to apply Citrix's fixes for CVE-2026-3055, warning that NetScaler ADC and Gateway appliances are widely exposed and often sit in critical identity and access paths. The advisory came amid reports of reconnaissance and active exploitation following disclosure.
On 2026-03-29, watchTowr Labs reported that CVE-2026-3055 comprises at least two memory overread variants, adding a newly described leak via the /wsfed/passive?wctx endpoint when the wctx parameter is present without a value. The researchers said honeypot data showed exploitation by known threat-actor-linked IPs had begun by 2026-03-27, and released tooling to help defenders detect exposed SAML IdP appliances.
On 2026-03-28, watchTowr Labs detailed how CVE-2026-3055 can leak residual memory from NetScaler SAML Identity Provider functionality when malformed or incomplete AuthnRequest data is sent to /saml/login. The researchers said stale heap data may be reflected in the NSC_TASS cookie and /var/log/ns.log, verified vulnerable and patched builds, and proposed detecting exposure by distinguishing NSC_TASS cookie responses from parsing errors.
On 2026-03-28, Defused Cyber and watchTowr reported observing active internet reconnaissance targeting Citrix NetScaler systems for CVE-2026-3055. The activity probed the /cgi/GetAuthMethods endpoint to fingerprint authentication methods and identify appliances configured as vulnerable SAML Identity Providers.
On 2026-03-28, a pull request to ProjectDiscovery's nuclei-templates repository proposed a detection template for CVE-2026-3055 ('CitrixBleed 3'). Review of the submission said the template only identified exposed SAML-related endpoints rather than confirming vulnerability status, and flagged its claims of in-the-wild probing as unsupported.
Citrix disclosed that the critical NetScaler memory overread flaw CVE-2026-3055 impacts Citrix ADC and Citrix Gateway only when configured as a SAML Identity Provider, while default configurations are not affected. The company also said it discovered the issue internally and that no in-the-wild exploitation or public proof-of-concept was known at the time.
On 2026-03-23, the Canadian Centre for Cyber Security and CERT-EU published advisories highlighting the Citrix NetScaler vulnerabilities and directing administrators to review Citrix's bulletin and apply recommended mitigations. These notices reinforced that vulnerable deployments included NetScaler ADC, NetScaler Gateway, and FIPS/NDcPP variants running affected versions.
On 2026-03-23, Citrix published a security advisory addressing critical vulnerabilities CVE-2026-3055 and CVE-2026-4368 in NetScaler ADC and NetScaler Gateway products. The advisory identified affected version branches, including 14.1, 13.1, and 13.1 FIPS/NDcPP releases below specified fixed builds, and provided patched versions or mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
32 references tracked. Mallory keeps watching after this page renders.
support.citrix.com
Open sourcebleepingcomputer.com
Open sourcejpcert.or.jp
Open sourcecyber.gc.ca
Open sourcecert.europa.eu
Open sourcerapid7.com
Open sourcekyberturvallisuuskeskus.fi
Open sourceinfosec.pub
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix published a security bulletin for **NetScaler ADC** and **NetScaler Gateway** covering two vulnerabilities tracked as `CVE-2026-3055` and `CVE-2026-4368`. The advisory identifies the affected product line and directs customers to vendor guidance for remediation, signaling that organizations using these edge-access and application delivery platforms should review exposure and apply Citrix-recommended updates or mitigations. Because **NetScaler ADC** and **NetScaler Gateway** are commonly deployed at the network perimeter for remote access, traffic management, and application delivery, the bulletin is relevant to internet-facing infrastructure and remote connectivity services. Security teams should inventory affected appliances, validate version status against the Citrix advisory, and prioritize patching or compensating controls to reduce the risk associated with the two listed CVEs.
Jun 29, 2026
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026