Vulnerabilities by vendor · updated on every deploy
Citrix vulnerabilities: exploited CVEs and our analysis
Citrix has 27 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 6 of them added in the last 12 months and 7 known to be used in ransomware campaigns. Below: the 5 analyses Zero Hunt Research published on Citrix products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
27
CVEs in CISA KEV
6
Added in the last 12 months
7
Known ransomware use
5
Zero Hunt analyses
Products with the most KEV entries: NetScaler (6) · NetScaler ADC and NetScaler Gateway (5) · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4) · NetScaler ADC and Gateway (2) · SD-WAN and NetScaler (2) · Session Recording (2)
Our analysis of Citrix vulnerabilities
2026-10-04
NetScaler CVE-2026-88779: an unauthenticated DoS crashing SAML gatewaysNetScaler CVE-2026-88779 is an unauthenticated memory-overflow DoS crashing SAML gateways, exploited in the wild. Fixed builds, KEV deadline, triage.
2026-09-28
NetScaler CVE-2026-88771/88772: two RCE zero-days exploited before the fixTwo unauthenticated NetScaler RCE zero-days, CVE-2026-88771/88772, exploited before a patch existed. Fixed builds, IOCs, and why the box can't clear you.
2026-07-13
ShareFile Shutdown: Reporting a Breach With No CVE, No Patch, No IOCsProgress told ShareFile admins to power off their Storage Zone Controllers over a credible threat — no CVE, no patch, no IOCs. How to hunt, contain, and file a NIS2 breach report while blind.
2026-07-07
CitrixBleed Again: CVE-2026-8451 and the Token You Already LostCVE-2026-8451 is a pre-auth NetScaler memory overread exploited within 24 hours. Patching stops the leak — it does not evict the session tokens attackers already stole.
2026-06-06
CitrixBleed 3: Why a March NetScaler Bug Is Your June EmergencyCVE-2026-3055 (CitrixBleed 3) was patched on 23 March. In early June, Fortinet confirmed large-scale exploitation. Here is why the patch alone never closed the door.
All 27 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-10-04 | CVE-2026-88779 | NetScaler Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a… | 2026-10-07 | Read → | |
| 2026-09-27 | CVE-2026-88772 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service | 2026-09-30 | Forensic triage | — |
| 2026-09-27 | CVE-2026-88771 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. | 2026-09-30 | Forensic triage | Read → |
| 2026-09-09 | CVE-2026-19490 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SS… | 2026-09-12 | Forensic triage | — |
| 2026-08-26 | CVE-2026-8452 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. | 2026-08-29 | — | |
| 2026-03-30 | CVE-2026-3055 | NetScaler Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory ove… | 2026-04-02 | — | |
| 2025-08-26 | CVE-2025-7775 | NetScaler Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service. | 2025-08-28 | — | |
| 2025-08-25 | CVE-2024-8069 | Session Recording Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user o… | 2025-09-15 | — | |
| 2025-08-25 | CVE-2024-8068 | Session Recording Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Window… | 2025-09-15 | — | |
| 2025-07-10 | CVE-2025-5777 | NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virt… | 2025-07-11 | Ransomware | — |
| 2025-06-30 | CVE-2025-6543 | NetScaler ADC and Gateway Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Prox… | 2025-07-21 | — | |
| 2024-01-17 | CVE-2023-6549 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | 2024-02-07 | — | |
| 2024-01-17 | CVE-2023-6548 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. | 2024-01-24 | — | |
| 2023-10-18 | CVE-2023-4966 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA… | 2023-11-08 | Ransomware | — |
| 2023-08-16 | CVE-2023-24489 | Content Collaboration Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers. | 2023-09-06 | — | |
| 2023-07-19 | CVE-2023-3519 | NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. | 2023-08-09 | Ransomware | — |
| 2022-12-13 | CVE-2022-27518 | Application Delivery Controller (ADC) and Gateway Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. | 2023-01-03 | — | |
| 2022-03-25 | CVE-2021-22941 | ShareFile Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller. | 2022-04-15 | Ransomware | — |
| 2022-03-25 | CVE-2019-12991 | SD-WAN and NetScaler Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance. | 2022-04-15 | — | |
| 2022-03-25 | CVE-2019-12989 | SD-WAN and NetScaler Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection. | 2022-04-15 | — | |
| 2022-03-25 | CVE-2017-6316 | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote att… | 2022-04-15 | — | |
| 2021-11-03 | CVE-2020-8196 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-8195 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-8193 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2019-19781 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-13608 | StoreFront Server Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2019-11634 | Workspace Application and Receiver for Windows Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives. | 2022-05-03 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Citrix vulnerabilities are in the CISA KEV catalog?
27 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2026-10-04. 6 were added in the last 12 months.
Which Citrix products have the most exploited vulnerabilities?
By KEV entries: NetScaler (6), NetScaler ADC and NetScaler Gateway (5), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4), NetScaler ADC and Gateway (2), SD-WAN and NetScaler (2), Session Recording (2).
Are Citrix vulnerabilities used in ransomware attacks?
CISA marks 7 of the 27 Citrix entries as known to be used in ransomware campaigns. The table flags them.
Is the next Citrix CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5