Active Exploitation of Citrix NetScaler Out‑of‑Bounds Read (CVE‑2026‑3055) Added to CISA KEV Catalog
What It Is — Citrix NetScaler (now Citrix ADC) contains an out‑of‑bounds read flaw (CVE‑2026‑3055) that allows an attacker to read arbitrary memory from the appliance. The defect resides in the handling of specially‑crafted network packets and can be a stepping‑stone to remote code execution.
Exploitability — CISA has placed the CVE in its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Public proof‑of‑concept code is circulating, and threat actors are targeting unpatched NetScaler deployments. CVSS v3.1 base score: 7.8 (High).
Affected Products — Citrix NetScaler/ADC appliances (all firmware versions prior to the March 2026 security update). The devices are widely used for load balancing, VPN termination, and web‑application firewall functions.
TPRM Impact — Organizations that outsource traffic management, VPN, or WAF services to vendors using Citrix NetScaler inherit the same exposure. A successful exploit can leak sensitive data or disrupt critical services, creating downstream breach risk and potentially violating contractual security clauses.
Recommended Actions —
- Deploy Citrix’s March 2026 firmware patch to all NetScaler/ADC instances immediately.
- Run authenticated scans to verify the patch is applied and no residual vulnerable versions remain.
- Isolate the appliance from untrusted networks and enforce strict inbound ACLs.
- Update third‑party risk registers to flag the KEV status, recalculate risk scores, and communicate remediation deadlines to affected suppliers.
Source: CISA Advisory – CVE‑2026‑3055