Vulnerabilità per vendor · aggiornato a ogni pubblicazione
Vulnerabilità Citrix: CVE sfruttate e nostre analisi
Citrix ha 27 vulnerabilità nel catalogo CISA Known Exploited Vulnerabilities, 6 delle quali aggiunte negli ultimi 12 mesi e 7 note per l'uso in campagne ransomware. Qui sotto: le 5 analisi pubblicate da Zero Hunt Research sui prodotti Citrix, poi le voci del catalogo dalla più recente, con la scadenza federale.
Catalogo CISA versione 2026.10.21, pubblicato il 2026-10-21 14:04 UTC.
27
CVE in CISA KEV
6
Aggiunte negli ultimi 12 mesi
7
Uso noto nel ransomware
5
Analisi Zero Hunt
Prodotti con più voci nel KEV: NetScaler (6) · NetScaler ADC and NetScaler Gateway (5) · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4) · NetScaler ADC and Gateway (2) · SD-WAN and NetScaler (2) · Session Recording (2)
Le nostre analisi delle vulnerabilità Citrix
2026-10-04
NetScaler CVE-2026-88779: un DoS non autenticato che manda offline i gateway SAMLCVE-2026-88779: memory overflow non autenticato che manda in crash i NetScaler con SAML, già sfruttato. Build corrette, scadenza KEV e triage forense.
2026-09-28
NetScaler CVE-2026-88771/88772: due zero-day RCE sfruttati prima della patchDue zero-day RCE non autenticati in NetScaler, CVE-2026-88771/88772, sfruttati prima della patch. Build corrette, IOC e perché i log non ti scagionano.
2026-07-13
ShareFile spento a mano: notificare una violazione senza CVE, patch o IOCProgress ha ordinato ai clienti ShareFile di spegnere gli Storage Zone Controller per una minaccia credibile — senza CVE, senza patch, senza IOC. Come cacciare, contenere e notificare secondo NIS2 mentre sei al buio.
2026-07-07
CitrixBleed di nuovo: CVE-2026-8451 e il token già persoCVE-2026-8451 è un memory overread pre-auth su NetScaler sfruttato entro 24 ore. La patch ferma la fuga, ma non revoca i session token che gli attaccanti hanno già rubato.
2026-06-06
CitrixBleed 3: perché un bug NetScaler di marzo è l'emergenza di giugnoCVE-2026-3055 (CitrixBleed 3) è stata corretta il 23 marzo. A inizio giugno Fortinet ha confermato lo sfruttamento su larga scala. Ecco perché la patch da sola non ha mai chiuso la porta.
Tutte le 27 voci KEV
| Aggiunta | CVE | Prodotto e vulnerabilità | Scadenza federale | Segnalazioni | Nostra analisi |
|---|---|---|---|---|---|
| 2026-10-04 | CVE-2026-88779 | NetScaler Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a… | 2026-10-07 | Leggi → | |
| 2026-09-27 | CVE-2026-88772 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service | 2026-09-30 | Triage forense | — |
| 2026-09-27 | CVE-2026-88771 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. | 2026-09-30 | Triage forense | Leggi → |
| 2026-09-09 | CVE-2026-19490 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SS… | 2026-09-12 | Triage forense | — |
| 2026-08-26 | CVE-2026-8452 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. | 2026-08-29 | — | |
| 2026-03-30 | CVE-2026-3055 | NetScaler Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory ove… | 2026-04-02 | — | |
| 2025-08-26 | CVE-2025-7775 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. | 2025-08-28 | — | |
| 2025-08-25 | CVE-2024-8069 | Session Recording Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user o… | 2025-09-15 | — | |
| 2025-08-25 | CVE-2024-8068 | Session Recording Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Window… | 2025-09-15 | — | |
| 2025-07-10 | CVE-2025-5777 | NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virt… | 2025-07-11 | Ransomware | — |
| 2025-06-30 | CVE-2025-6543 | NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Prox… | 2025-07-21 | — | |
| 2024-01-17 | CVE-2023-6549 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | 2024-02-07 | — | |
| 2024-01-17 | CVE-2023-6548 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. | 2024-01-24 | — | |
| 2023-10-18 | CVE-2023-4966 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA… | 2023-11-08 | Ransomware | — |
| 2023-08-16 | CVE-2023-24489 | Content Collaboration Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers. | 2023-09-06 | — | |
| 2023-07-19 | CVE-2023-3519 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. | 2023-08-09 | Ransomware | — |
| 2022-12-13 | CVE-2022-27518 | Application Delivery Controller (ADC) and Gateway Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. | 2023-01-03 | — | |
| 2022-03-25 | CVE-2021-22941 | ShareFile Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. | 2022-04-15 | Ransomware | — |
| 2022-03-25 | CVE-2019-12991 | SD-WAN and NetScaler Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. | 2022-04-15 | — | |
| 2022-03-25 | CVE-2019-12989 | SD-WAN and NetScaler Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection. | 2022-04-15 | — | |
| 2022-03-25 | CVE-2017-6316 | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote att… | 2022-04-15 | — | |
| 2021-11-03 | CVE-2020-8196 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-8195 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-8193 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2019-19781 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-13608 | StoreFront Server Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-11634 | Workspace Application and Receiver for Windows Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. | 2022-05-03 | Ransomware | — |
Fonte: catalogo CISA Known Exploited Vulnerabilities (dati pubblici). Le descrizioni sono di CISA, abbreviate. Verifica sempre l'advisory del vendor prima di intervenire. cisa.gov
Prima della patch: tre verifiche
- 01Confronta la versione e la configurazione esatte che usi con l'advisory del vendor. Avere il prodotto non significa essere esposti.
- 02Verifica la raggiungibilità: una falla sfruttata su un'interfaccia raggiungibile da internet, o da una postazione compromessa, passa in testa alla coda.
- 03Dove CISA indica il triage forense, oltre alla patch cerca tracce di compromissione: la correzione non elimina un attaccante entrato prima.
Domande
Quante vulnerabilità Citrix ci sono nel catalogo CISA KEV?
27 nella versione 2026.10.21 del catalogo, la prima aggiunta il 2021-11-03 e la più recente il 2026-10-04. 6 sono state aggiunte negli ultimi 12 mesi.
Quali prodotti Citrix hanno più vulnerabilità sfruttate?
Per numero di voci KEV: NetScaler (6), NetScaler ADC and NetScaler Gateway (5), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4), NetScaler ADC and Gateway (2), SD-WAN and NetScaler (2), Session Recording (2).
Le vulnerabilità Citrix sono usate negli attacchi ransomware?
CISA indica 7 delle 27 voci Citrix come note per l'uso in campagne ransomware. Nella tabella sono segnalate.
La prossima CVE Citrix è sfruttabile nella tua rete?
Una voce KEV dice che una vulnerabilità è sfruttata da qualche parte. Zero Hunt risponde se è sfruttabile nel tuo ambiente: un red team AI autonomo su un'appliance on-premise, con AI privata, in black box o gray box e con una persona che approva ogni passo che conta.
Altri vendor: Cisco · Microsoft · Fortinet · Linux kernel · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5