What happened
Hackers are probing Citrix NetScaler instances ahead of likely CVE-2026-3055 exploitation, as researchers report active reconnaissance against internet-facing appliances. watchTowr and Defused Cyber said threat actors are targeting CVE-2026-3055, a high-severity memory overread flaw with a CVSS score of 9.3 that affects Citrix NetScaler ADC and Gateway appliances. The issue stems from insufficient input validation and can allow unauthenticated attackers to extract sensitive data. The flaw is only exploitable when NetScaler ADC or Gateway is configured as a SAML Identity Provider. Researchers said attackers are sending HTTP POST requests to the /cgi/GetAuthMethods endpoint to fingerprint exposed systems and determine whether they are configured in a vulnerable way before likely moving into broader exploitation.
Who is affected
The direct exposure affects organizations running Citrix NetScaler ADC or Gateway appliances configured as a SAML Identity Provider, especially where those systems are internet-facing. The article describes substantial potential attack surface because this profile is commonly used in enterprise single sign-on environments.
Why CISOs should care
This matters because the activity described is not theoretical. Researchers said attackers are already carrying out configuration-aware reconnaissance designed to identify exactly which exposed NetScaler systems can be exploited. It also involves perimeter identity infrastructure that supports enterprise authentication and cloud service integrations.
3 practical actions
- Patch affected appliances immediately: Prioritize immediate deployment of the latest Citrix security updates on any affected NetScaler ADC or Gateway systems configured as a SAML Identity Provider.
- Review exposure of the SAML endpoint: Identify which internet-facing NetScaler instances are operating as a SAML Identity Provider, since that configuration is required for exploitation of CVE-2026-3055.
- Monitor for reconnaissance tied to the flaw: Hunt for suspicious HTTP POST requests to the /cgi/GetAuthMethods endpoint, as researchers linked that probing activity directly to attackers identifying vulnerable authentication setups.
For more news about security flaws under active targeting, click Vulnerability to read more.