Citrix vulnerabilities in CISA KEV
Citrix has 27 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 11th highest of any vendor. 6 were added in the last 12 months; 7 are linked to known ransomware use (25.9% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 1 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is NetScaler, with 6 entries. Other frequently affected products: NetScaler ADC and NetScaler Gateway (5); Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor citrix --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
27
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-10-04
most recent entry
┌─ last 12 months
6
entries added
┌─ ransomware use
7 of 27
25.9% linked to ransomware
┌─ distinct products
12
affected products
$ awk -F, {print $1} /var/log/kev/citrix.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 6 | 3 |
| 2022 | 5 | 1 |
| 2023 | 3 | 2 |
| 2024 | 2 | 0 |
| 2025 | 5 | 1 |
| 2026 | 6 | 0 |
$ sort /var/log/kev/citrix.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- NetScaler 6 entries
- NetScaler ADC and NetScaler Gateway 5 entries
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance 4 entries
- NetScaler ADC and Gateway 2 entries
- SD-WAN and NetScaler 2 entries
$ kev-due-dates --vendor citrix
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Citrix
21 days (range 1 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/citrix.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (26 of 27 have at least one CWE).
$ grep -ril 'Citrix' /var/log/news | head -5
Our reporting that names Citrix or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./citrix.kev · 27 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-88779
NetScaler
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
due 2026-10-07 · CWE-119
$ cat CVE-2026-88779.txt
Description. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-88771
NetScaler
Citrix NetScaler Improper Input Validation Vulnerability
due 2026-09-30 · CWE-119
$ cat CVE-2026-88771.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-88772
NetScaler
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
due 2026-09-30 · CWE-119
$ cat CVE-2026-88772.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-19490
NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
due 2026-09-12 · CWE-288
$ cat CVE-2026-19490.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-8452
NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
due 2026-08-29 · CWE-119
$ cat CVE-2026-8452.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-3055
NetScaler
Citrix NetScaler Out-of-Bounds Read Vulnerability
due 2026-04-02 · CWE-125
$ cat CVE-2026-3055.txt
Description. Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-7775
NetScaler
Citrix NetScaler Memory Overflow Vulnerability
due 2025-08-28 · CWE-119
$ cat CVE-2025-7775.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-8068
Session Recording
Citrix Session Recording Improper Privilege Management Vulnerability
due 2025-09-15 · CWE-269
$ cat CVE-2024-8068.txt
Description. Citrix Session Recording contains an improper privilege management vulnerability that could allow for privilege escalation to NetworkService Account access. An attacker must be an authenticated user in the same Windows Active Directory domain as the session recording server domain.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-8069
Session Recording
Citrix Session Recording Deserialization of Untrusted Data Vulnerability
due 2025-09-15 · CWE-502
$ cat CVE-2024-8069.txt
Description. Citrix Session Recording contains a deserialization of untrusted data vulnerability that allows limited remote code execution with privilege of a NetworkService Account access. Attacker must be an authenticated user on the same intranet as the session recording server.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-5777
NetScaler ADC and Gateway [RANSOMWARE]
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
due 2025-07-11 · CWE-125
$ cat CVE-2025-5777.txt
Description. Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-6543
NetScaler ADC and Gateway
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
due 2025-07-21 · CWE-119
$ cat CVE-2025-6543.txt
Description. Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-6548
NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
due 2024-01-24 · CWE-94
$ cat CVE-2023-6548.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-6549
NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
due 2024-02-07 · CWE-119
$ cat CVE-2023-6549.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-4966
NetScaler ADC and NetScaler Gateway [RANSOMWARE]
Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
due 2023-11-08 · CWE-119
$ cat CVE-2023-4966.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Required action. Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- CVE-2023-24489
Content Collaboration
Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
due 2023-09-06 · CWE-284
$ cat CVE-2023-24489.txt
Description. Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-3519
NetScaler ADC and NetScaler Gateway [RANSOMWARE]
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
due 2023-08-09 · CWE-94
$ cat CVE-2023-3519.txt
Description. Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-27518
Application Delivery Controller (ADC) and Gateway
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
due 2023-01-03 · CWE-664
$ cat CVE-2022-27518.txt
Description. Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Required action. Apply updates per vendor instructions.
- CVE-2017-6316
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
Citrix Multiple Products Remote Code Execution Vulnerability
due 2022-04-15 · CWE-20
$ cat CVE-2017-6316.txt
Description. A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Required action. Apply updates per vendor instructions.
- CVE-2019-12989
SD-WAN and NetScaler
Citrix SD-WAN and NetScaler SQL Injection Vulnerability
due 2022-04-15 · CWE-89
$ cat CVE-2019-12989.txt
Description. Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
Required action. Apply updates per vendor instructions.
- CVE-2019-12991
SD-WAN and NetScaler
Citrix SD-WAN and NetScaler Command Injection Vulnerability
due 2022-04-15 · CWE-78
$ cat CVE-2019-12991.txt
Description. Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
Required action. Apply updates per vendor instructions.
- CVE-2021-22941
ShareFile [RANSOMWARE]
Citrix ShareFile Improper Access Control Vulnerability
due 2022-04-15 · CWE-284
$ cat CVE-2021-22941.txt
Description. Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.
Required action. Apply updates per vendor instructions.
- CVE-2019-11634
Workspace Application and Receiver for Windows [RANSOMWARE]
Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability
due 2022-05-03
$ cat CVE-2019-11634.txt
Description. Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
Required action. Apply updates per vendor instructions.
- CVE-2019-13608
StoreFront Server [RANSOMWARE]
Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability
due 2022-05-03 · CWE-611
$ cat CVE-2019-13608.txt
Description. Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Required action. Apply updates per vendor instructions.
- CVE-2019-19781
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance [RANSOMWARE]
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2019-19781.txt
Description. Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
Required action. Apply updates per vendor instructions.
- CVE-2020-8193
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
due 2022-05-03 · CWE-284
$ cat CVE-2020-8193.txt
Description. Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
Required action. Apply updates per vendor instructions.
- CVE-2020-8195
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
due 2022-05-03 · CWE-20
$ cat CVE-2020-8195.txt
Description. Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Required action. Apply updates per vendor instructions.
- CVE-2020-8196
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
due 2022-05-03 · CWE-284
$ cat CVE-2020-8196.txt
Description. Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Required action. Apply updates per vendor instructions.