Cybercriminals are taking advantage of a high-risk security weakness, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway devices to steal confidential information.

Citrix initially announced CVE-2026-3055 in a security advisory on March 23, along with another flaw, CVE-2026-4368, a high-severity race condition. This vulnerability affects versions of these products prior to 14.1-60.58, older than 13.1-62.23, and older than 13.1-37.262.

The company stated that the vulnerability only impacts devices configured as a SAML identity provider (IDP) and that only administrators managing on-premise devices need to take action.

Following the advisory, numerous cybersecurity firms pointed out that CVE-2026-3055 poses a serious threat, noting its similarity to the widely exploited ‘CitrixBleed’ and CitrixBleed2′ vulnerabilities from 2023 and 2025, respectively.

watchTowr, a company focused on adversarial simulation and continuous testing, reported on Saturday that it has detected reconnaissance activity targeting vulnerable systems and warned that exploitation in real-world scenarios was imminent.

The next day, the researchers verified that malicious actors had begun exploiting the security flaw since at least March 27 to steal authentication administration session IDs, which could enable complete control of NetScaler appliances.

“Real-world exploitation has been observed, with our honeypot network showing exploitation originating from known malicious IP addresses as of March 27th,” watchTowr reports.

watchTowr’s analysis suggests that CVE-2026-3055 actually encompasses at least two different memory overread errors, not just one. The first impacts the ‘/saml/login’ endpoint, which handles SAML authentication, while the second impacts the ‘/wsfed/passive’ endpoint, used for WS-Federation passive authentication.

The researchers demonstrated that the vulnerability can be used to gain “sensitive information – including authenticated administrative session IDs.”

The researchers described Citrix’s partial disclosure of the security issue in the advisory as “misleading.” They also provided a Python script to help security teams identify vulnerable hosts in their environments.

At the time of publication, Citrix’s advisory does not mention CVE-2026-3055 being actively exploited. BleepingComputer has contacted Citrix for comment on the reported malicious activity targeting unpatched devices, but has not yet received a response.

As of March 28, The ShadowServer Foundation observes 29,000 NetScaler and 2,250 Gateway devices accessible online, although the number vulnerable to CVE-2026-3055 is unknown.