Attackers Target Flaws in F5 and Citrix Gear

Flaws in major application delivery and security platforms and VPN gateways are being actively exploited or targeted by attackers.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Appliances under fire include F5 devices – a vulnerability in the BIG-IP Access Policy Manager can be remotely exploited to execute code, the vendor warned.

Separately, researchers said attackers have begun targeting a “memory overread” flaw in NetScaler – formerly known as Citrix – Application Delivery Controller, which the vendor found and first detailed to customers on March 23.

F5 Appliances Under Fire

Seattle-based F5’s multi-cloud security and application delivery platform is widely used, including by many large organizations and continues to be regularly targeted by hackers, specifically nation-state actors (see: ‘It’s Been a Mess’: Shutdown Slows Federal F5 Hack Response).

A flaw now being targeted in the F5 BIG-IP APM software first came to light last year. F5’s security advisory for CVE-2025-53521, first published on Oct. 15, 2025, categorized the bug as being a denial-of-service vulnerability with a “high” CVSS v4.0 score of 8.7.

On Friday, amid reports of active exploitation, F5 said new information has led it to recategorize the flaw as being a remote code execution vulnerability with a “critical” CVSS v4.0 score of 9.3.

“When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to remote code execution,” the company said.

“This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure,” F5 said.

In F5 products, the data plane refers to getting and returning data from systems and users, including routing that data, while the control plane typically involves management features, such as logging, provisioning and licensing.

“When F5 CVE-2025-53521 first emerged last year as a denial-of-service issue, it didn’t immediately signal urgency, and many system administrators likely prioritized it accordingly,” said Benjamin Harris, CEO of threat intelligence firm watchTowr.

The revised security alert offers “a very different risk profile than what was initially communicated,” and while immediately patching is mandatory, all users also should focus “on determining whether this has already been exploited in their environments,” he advised.

The U.S. Cybersecurity and Infrastructure Security Agency on Friday added the vulnerability to its catalog of known exploited flaws. CISA set a Monday deadline for federal civilian agencies to either patch the flaw or temporarily discontinue using the vulnerable products.

Britain’s National Cyber Security Center said it “recommends investigating for compromise on all affected products regardless of when the system was updated,” using indicators of compromise published by F5.

The NCSC noted that “F5 BIG-IP APM is a common component, especially within large enterprises,” and urged all organizations to use it “to take immediate action to mitigate” the vulnerability.

“Attackers have been deploying webshells, so boxes are still vuln post patching if already exploited prior,” said British cybersecurity researcher Kevin Beaumont in a post to social platform Mastodon.

NetScaler Memory Leak Targeted

Urgent patch alerts are also being sounded after Citrix on March 23 first detailed CVE-2026-3055 and CVE-2026-4368, affecting customer-managed NetScaler ADC and NetScaler Gateway devices. The latter are VPN gateway appliances, and both remain widely used.

Citrix is part of the Cloud Software Group, headquartered in Fort Lauderdale, Florida.

The vendor said CVE-2026-3055 is an “insufficient input validation leading to memory overread” flaw, has a “critical” CVSS v4.0 score of 9.3, and affects NetScaler ADC and NetScaler Gateway version 14.1 before 14.1-60.58, and 13.1 before 13.1-62.23, plus NetScaler ADC FIPS and NDcPP before 13.1-37.262. To be vulnerable, a device must have been configured to serve as a SAML Identity Provider, aka IDP.

The flaw came to light “internally through our ongoing security reviews,” said Citrix, which is advising customers to address the vulnerability by updating to a patched version of its software, such as 14.1-60.58.

The other flaw, CVE-2026-4368, a “race condition leading to user session mix-up,” has a CVSS v4.0 base score of 7.7 and only affects NetScaler ADC and NetScaler Gateway version 14.1-66.54, if the appliance has been configured to serve as a gateway or a AAA virtual server, Citrix said.

While the vendor didn’t detail how CVE-2026-3055 might be abused, memory leak vulnerabilities can potentially be exploited by an attacker to obtain sensitive information.

“A memory overread vulnerability occurs when an application reads beyond the intended boundaries of an allocated memory region. Unlike buffer overflows (which write to adjacent memory), overread vulnerabilities leak data that should remain isolated – typically credentials, session tokens, encryption keys or application configuration details,” said agentic pen-testing firm Hadrian.

For CVE-2026-3055, Hadrian advises that “organizations treat this as an urgent remediation priority,” given the widespread targeting by attackers of previously discovered memory leak vulnerabilities in Citrix products.

The CVE-2026-3055 designation appears to refer to not just one, but two vulnerabilities, as well as to facilitate the theft of “authenticated administrative session IDs,” watchTowr said in a Saturday research report.

“During the course of reproducing this N-day, we found additional memory-overread vulnerabilities with similar prerequisites to CVE-2026-3055,” and said it’s forwarded these to Citrix’s product security incident response team.

Citrix devices have continued to suffer from a variety of memory overread flaws, including CitrixBleed, CitrixBleed2 and another discovered in 2025 (see: Citrix NetScaler Devices Yet Again Under Attack).

On the heels of those discoveries, watchTowr last year warned that “memory management continues to appear fragile within Citrix NetScaler appliances to the extent that even accidentally misconfiguring an appliance can lead to the disclosure of leaked memory.”

This is a concern, given that “NetScaler Gateway specifically serves as the front door for thousands of organizations’ remote access infrastructure,” it said. The appliances have been frequently targeted by ransomware-wielding attackers as well as suspected nation-state threat groups.