In 2015, a coroner ruled Cpl James Dunsby, L/Cpl Corporal Edward Maher and L/Cpl Craig Roberts died as a result of neglect on the 16-mile march.
The report, commissioned by the Ministry of Defence, said failures at multiple levels led to the deaths.
The MoD said recommendations in the report were being addressed.
The report has been published by the independent watchdog, the Defence Safety Agency, which monitors the MoD on its behalf.
It concluded: "These reserves currently remain vulnerable to a further incident in the future."
The soldiers had been taking part in a recruitment exercise on what was the hottest day of 2013.
The report said the officers in charge did not plan for the weather, and health and safety guidance was inadequate.
A combination of "cultural drift" and uncertainty about the role of the reserves in general meant that no-one questioned whether the gruelling training was appropriate for part-time soldiers, it said.
The report echoed concerns raised in investigations by a coroner and the Health and Safety Executive which, in March 2016, said the MoD would be censured - the highest action the HSE can take.
An MoD spokesperson said: "Our deepest sympathies remain with the families of all three soldiers and, with all the recommendations from this report having been or being addressed, we are committed to doing all we can to ensure such a tragic event cannot happen again."
Cpl Dunsby, from Trowbridge, Wiltshire, L/Cpl Roberts, from Penrhyn Bay, Conwy, and L/Cpl Maher, of Winchester, Hampshire, had been on course to complete the exercise within the allocated time but were found in three separate locations at different times.
An inquest found they died after suffering the effects of hyperthermia - or overheating.
A new report into the deaths of three soldiers during an SAS exercise in the Brecon Beacons in 2013 has concluded it could happen again.