Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Citrix: actively exploited vulnerabilities

26 vulnerabilities in Citrix products (NetScaler ADC / Gateway, SD-WAN, Session Recording…) are in CISA’s catalog of exploited vulnerabilities, 4 of them added in the last 90 days. Last added: September 27, 2026.

Citrix security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

Active CERT-FR alert: CERTFR-2026-ALE-011 — Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway

By category

Add just one Citrix category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • NetScaler ADC / Gateway 17 vulnerabilities · ADCs
  • SD-WAN 3 vulnerabilities · Switches and routers
  • Session Recording 2 vulnerabilities · Virtualization and VDI
  • ShareFile 2 vulnerabilities · File transfer (MFT)
  • StoreFront 1 vulnerability · Virtualization and VDI
  • Workspace app / Receiver 1 vulnerability · Virtualization and VDI

Name used by CISA: Citrix. Product families: indicative classification by this site.

Pace of additions

Number of Citrix vulnerabilities added to CISA’s KEV catalog, per 30-day period (the last one, still in progress, ends on September 28, 2026). Source: CISA KEV catalog.
Catalog additions per 30-day period
PeriodVulnerabilities added
Sep 4, 2025 to Oct 3, 20250
Oct 4, 2025 to Nov 2, 20250
Nov 3, 2025 to Dec 2, 20250
Dec 3, 2025 to Jan 1, 20260
Jan 2, 2026 to Jan 31, 20260
Feb 1, 2026 to Mar 2, 20260
Mar 3, 2026 to Apr 1, 20261
Apr 2, 2026 to May 1, 20260
May 2, 2026 to May 31, 20260
Jun 1, 2026 to Jun 30, 20260
Jul 1, 2026 to Jul 30, 20260
Jul 31, 2026 to Aug 29, 20261
Aug 30, 2026 to Sep 28, 2026 (in progress)3

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Citrix list.

  1. Rank 1Citrix NetScaler ADC / Gateway

    CVE-2026-88771

    Recently addedActive CERT-FR alertHunt for compromise (CISA)

    Citrix NetScaler Improper Input Validation Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 27, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  2. Rank 2Citrix NetScaler ADC / Gateway

    CVE-2026-88772

    Recently addedActive CERT-FR alertHunt for compromise (CISA)

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 27, 2026
    CISA deadline
    3 days
    CVSS severity
    8.1 (high)

  3. Rank 3Citrix NetScaler ADC / Gateway

    CVE-2026-19490

    Recently addedHunt for compromise (CISA)

    Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 9, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  4. Rank 4Citrix NetScaler ADC / Gateway

    CVE-2026-8452

    Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Aug 26, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  5. Rank 5Citrix NetScaler ADC / Gateway

    CVE-2026-3055

    Citrix NetScaler Out-of-Bounds Read Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Mar 30, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  6. Rank 6Citrix NetScaler ADC / Gateway

    CVE-2025-7775

    Citrix NetScaler Memory Overflow Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 26, 2025
    CISA deadline
    2 days
    CVSS severity
    9.8 (critical)

  7. Rank 7Citrix NetScaler ADC / Gateway

    CVE-2025-6543

    Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jun 30, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  8. Rank 8Citrix ShareFile

    CVE-2023-24489

    Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 16, 2023
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  9. Rank 9Citrix NetScaler ADC / Gateway

    CVE-2023-3519

    Ransomware

    Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jul 19, 2023
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  10. Rank 10Citrix NetScaler ADC / Gateway

    CVE-2022-27518

    Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Dec 13, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)
Show 16 more vulnerabilities

  1. Rank 11Citrix SD-WAN

    CVE-2017-6316

    CVE from 2017, added in 2022

    Citrix Multiple Products Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  2. Rank 12Citrix SD-WAN

    CVE-2019-12989

    CVE from 2019, added in 2022

    Citrix SD-WAN and NetScaler SQL Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 13Citrix ShareFile

    CVE-2021-22941

    Ransomware

    Citrix ShareFile Improper Access Control Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  4. Rank 14Citrix Workspace app / Receiver

    CVE-2019-11634

    RansomwareCVE from 2019, added in 2021

    Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    9.8 (critical)

  5. Rank 15Citrix NetScaler ADC / Gateway

    CVE-2019-19781

    RansomwareCVE from 2019, added in 2021

    Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    9.8 (critical)

  6. Rank 16Citrix NetScaler ADC / Gateway

    CVE-2023-6548

    Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jan 17, 2024
    CISA deadline
    7 days
    CVSS severity
    8.8 (high)

  7. Rank 17Citrix SD-WAN

    CVE-2019-12991

    CVE from 2019, added in 2022

    Citrix SD-WAN and NetScaler Command Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    8.8 (high)

  8. Rank 18Citrix Session Recording

    CVE-2024-8068

    Citrix Session Recording Improper Privilege Management Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 25, 2025
    CISA deadline
    21 days
    CVSS severity
    8.0 (high)

  9. Rank 19Citrix Session Recording

    CVE-2024-8069

    Citrix Session Recording Deserialization of Untrusted Data Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 25, 2025
    CISA deadline
    21 days
    CVSS severity
    8.0 (high)

  10. Rank 20Citrix NetScaler ADC / Gateway

    CVE-2025-5777

    Ransomware

    Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jul 10, 2025
    CISA deadline
    1 day
    CVSS severity
    7.5 (high)

  11. Rank 21Citrix NetScaler ADC / Gateway

    CVE-2023-6549

    Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jan 17, 2024
    CISA deadline
    21 days
    CVSS severity
    7.5 (high)

  12. Rank 22Citrix NetScaler ADC / Gateway

    CVE-2023-4966

    Ransomware

    Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Oct 18, 2023
    CISA deadline
    21 days
    CVSS severity
    7.5 (high)

  13. Rank 23Citrix StoreFront

    CVE-2019-13608

    RansomwareCVE from 2019, added in 2021

    Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    7.5 (high)

  14. Rank 24Citrix NetScaler ADC / Gateway

    CVE-2020-8193

    Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    6.5 (medium)

  15. Rank 25Citrix NetScaler ADC / Gateway

    CVE-2020-8195

    Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    6.5 (medium)

  16. Rank 26Citrix NetScaler ADC / Gateway

    CVE-2020-8196

    Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    4.3 (medium)

Follow and verify

Get new Citrix vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.