A critical security vulnerability, CVE-2026-3055, with a CVSS score of 9.3, has been discovered in Citrix NetScaler ADC and NetScaler Gateway, allowing attackers to exploit a memory overread bug due to insufficient input validation. This flaw can be leveraged to leak sensitive information, and active reconnaissance activity has been detected by Defused Cyber and watchTowr. The vulnerability is considered high-risk, and its disclosure has expanded the active attack surface. Citrix NetScaler users are advised to take immediate action to mitigate potential exploitation. The fact that attackers are already actively searching for vulnerable systems1 highlights the urgency of addressing this issue. So what matters to practitioners is that they must prioritize patching and monitoring their systems based on their exposure and exploitation evidence to prevent potential breaches.