Six Days Ahead: How eSentire Detected NetScaler Exploitation Before the Industry Caught Up

On April 2, 2026, eSentire’s Threat Response Unit (TRU) identified active exploitation attempts targeting Citrix NetScaler ADC and Gateway devices, six days before industry-standard network detection rules were published.

This wasn’t theoretical; it was real attacker activity, observed across customer environments, blocked before it could progress. Here’s what happened, and why it matters.

The Vulnerability: CVE-2026-3055

Citrix NetScaler ADC and Gateway devices configured as SAML identity providers were found vulnerable to a memory overread caused by improper input validation. Shortly after watchTowr Labs published proof-of-concept exploit code, active scanning began.

This exploit targets Netscaler appliances on the customer network. These appliances are not running endpoint agents, and therefore visibility must be sourced from live network traffic. eSentire's NETWORK signal ingestion executes cutting edge detection tradecraft to validate otherwise benign IOCs.

What eSentire Saw

eSentire identified exploitation attempts across customer environments and correlated 28+ attacker source Ips, with a single IP responsible for 73% of all observed activity. eSentire’s TRU team worked with the SOC to push protections across all customers, leveraging eSentire’s Network detection & response capabilities, blocking the activity before it could progress.

Our proprietary detection methods, built from real-world threat research, matched the exact attack patterns in network traffic. This was proactive security, with an intelligence-led approach that helped identify and drive protocol-level analysis and attacker behavioral fingerprinting.

Why This Matters

Most organizations rely on published signatures and detection rules from third-party feeds. In this case, those rules arrived on April 8, six days after exploitation attempts had already begun. 

Six days is an eternity - Mandiant now puts mean time-to-exploit at –7 days, meaning attackers are exploiting them before the patch is available.

Where other providers wait for patches and signatures, eSentire deploys proprietary detection methods built from real-world threat research and intelligence. Coverage isn’t limited to what’s published; it extends to how attackers actually behave in the wild.

The Bigger Picture: AI-Driven Vulnerability Discovery

Programs like the Mythos Preview: Project Glasswing are accelerating vulnerability discovery at scale, using AI to find flaws in software before attackers do. This is valuable work, which will inevitably lead to stronger critical infrastructure and stronger core platforms that society relies on today, but discovery alone doesn’t protect anyone.

Glasswing is a vulnerability discovery program for software producers. eSentire’s role sits downstream: we detect and respond to the exploitation of vulnerabilities that Glasswing and similar efforts surface across your environment.

As AI-driven discovery programs increase the volume and velocity of disclosed vulnerabilities, the gap between disclosure and exploitation will shrink. Organizations need an operational layer that doesn’t wait for signatures, one that detects attacker behavior in real time.

Detection without action is noise. eSentire closes the loop.

What You Should Do Now

If your organization runs Citrix NetScaler ADC or Gateway devices configured as SAML identity providers, apply the Citrix security update for CVE-2026-3055 immediately. Review your network detection capabilities. If your security provider can’t see appliance-level traffic, this exploit is invisible to them.

eSentire customers with network signal ingestion were and are protected. TRU deployed custom detection rules on April 2 and continues to monitor for related activity. If your current deployment doesn't include NETWORK signals, talk to your eSentire advisor about closing that gap.