Citrix NetScaler Exploit Alert: Critical Vulnerabilities Exploited

Post Views: 10

Exploitation of Fresh Citrix NetScaler Vulnerability Underway

Citrix NetScaler appliances configured as SAML Identity Providers (SAML IDPs) and running outdated software have fallen prey to in-the-wild exploitation of a recently disclosed critical-severity vulnerability, according to attack surface management firm WatchTowr.

Vulnerability Details

Vulnerability Name: CVE-2026-3055
CVSS Score: 9.3
Impact: Critical

The security defect, an out-of-bounds read issue, was reportedly discovered and addressed internally by Citrix. However, the company cautioned that threat actors were likely to capitalize on the vulnerability soon after disclosure, drawing parallels with notorious vulnerabilities like CitrixBleed and CitrixBleed2.

WatchTowr noted that initial reconnaissance attempts against vulnerable NetScaler instances began on Friday, followed by the onset of active exploitation on Sunday. According to their findings, the exploitation is attributed to a specific parameter missing from malicious requests, causing an unpatched Citrix NetScaler to inadvertently check for the presence of associated data, leading to sensitive information leakage.

Evidence suggests that in-the-wild exploitation of vulnerable NetScaler instances commenced at least by March 27. The company demonstrated sensitive information leakage by revealing the ID of an authenticated administrative session, illustrating the potential consequences of this vulnerability.

According to WatchTowr, the exploitation method is akin to CitrixBleed2, where a particular parameter must be absent from malicious requests to facilitate the exposure of dead memory. As a result, repeated attempts yield varying information due to the dynamic nature of the memory involved.