Citrix NetScaler: Vulnerability used in reconnaissance activities

A new serious security vulnerability affecting Citrix NetScaler ADC and NetScaler Gatewayhas put organizations worldwide on alert, as reconnaissance activity by attackers is already being recorded. The vulnerability, documented as CVE-2026-3055, is related to insufficient input validation and can lead to memory overread. This means that a malicious actor could extract sensitive information from the system's memory, opening the way for further attacks.

How the vulnerability works and why it is dangerous

According to the technical details, successful exploitation of the vulnerability depends on whether the device is configured as a SAML Identity Provider. In such cases, the system is exposed to specific endpoints that can be targeted by attackers. Through memory overread, hackers may gain access to credentials, session tokens, or other critical data, which can be exploited for account compromise or lateral movement within the network.

See also: Citrix NetScaler: Critical vulnerability exposes data

Active reconnaissance by attackers in real time

Researchers from Defused Cyber ​​and watchTowr confirm that the threat is not theoretical. Attempts to “map” vulnerable systems through requests to the “/cgi/GetAuthMethods” endpoint have already been detected. In this way, attackers try to identify which authentication methods are active and whether the system is operating as a SAML IDP. The data comes from honeypots, i.e. controlled environments used to detect malicious activity, which enhances the reliability of the findings.

From recognition to exploitation: One small step

Experts warn that the transition from reconnaissance to active exploitation can happen extremely quickly. As watchTowr points out, once attackers confirm vulnerable configurations, the time frame for organizations to react is dramatically reduced. In such scenarios, even a few hours of delay in applying updates can prove critical.

See also: Recently fixed Citrix NetScaler bug was used as a zero-day

History of vulnerabilities and recurring attack patterns

The concern is heightened by the fact that NetScaler products have repeatedly been targeted by attackers in recent years. Vulnerabilities such as CVE-2023-4966, CVE-2025-5777, CVE-2025-6543 and CVE-2025-7775 have already been exploited in real-world attacks, with significant impacts for businesses and organizations. This recurring pattern suggests that attackers are closely monitoring developments around the platform and acting promptly when a new security gap.

The importance of immediate response and updates

Cybersecurity experts emphasize that the immediate installation of available patches is the only reliable defense. Organizations using affected versions are urged to proceed without delay with updates and review security configurations their. At the same time, it is recommended to monitor network activity for suspicious requests and strengthen threat detection mechanisms.

The bigger picture: Growing pressure on access infrastructure

This incident highlights a broader trend: remote access and identity management infrastructures are now a key target for cybercriminals. With the spread of telecommuting and cloud services, solutions like NetScaler are at the core of corporate operations. This makes them particularly attractive targets, as a successful breach can provide widespread access to critical systems.

See also: Amazon: Cisco ISE and Citrix NetScaler zero-day exploit

Conclusion: It's not a matter of "if", but "when"

The new vulnerability CVE-2026-3055 comes as a stark reminder that the cyberthreat landscape remains dynamic and unpredictable. Given the history of active exploitation of similar vulnerabilities, immediate mobilization is not an option but a necessity. For organizations, the challenge is not just to address this specific threat, but to adopt a more proactive security strategy that can respond to the constantly evolving tactics of attackers.