Citrix vulnerabilities
Citrix NetScaler ADC and Gateway vulnerabilities, including session-hijacking flaws like Citrix Bleed that bypass MFA entirely.
We track 28 Citrix CVEs, 27 of them on CISA's Known Exploited Vulnerabilities catalog (7 flagged for ransomware use). The latest KEV addition is CVE-2026-88779, added .
- CVEs tracked
- 28
- On CISA KEV
- 27
- Ransomware use
- 7
- Rated critical
- 15
Most-exploited Citrix products
Latest Citrix coverage
Our reporting filed under Citrix, plus any story that cites one of its CVEs.
Citrix, Fortinet, Ivanti Patch 29 CVEs on Patch Tuesday
Fortinet, Citrix, and Ivanti each released October patches today, closing 29 vulnerabilities including critical-severity flaws in edge network products.
Citrix NetScaler: Critical CVSS 9.5 RCE, Patch Now
CVE-2026-107406, CVSS 9.5, is a memory overflow in Citrix NetScaler that allows unauthenticated RCE or DoS in SAML-configured deployments. Patch now.
Citrix Patches Third NetScaler Zero-Day in Two Weeks
CVE-2026-88779 is a NetScaler DoS flaw exploited in zero-day attacks against SAML deployments, now in CISA KEV with a federal patch deadline of October 7.
NetScaler Web Shells Confirmed: KEV Deadline Is Today
Cybersecurity firms document the CVE-2026-88772 attack chain: web shells, tunneling malware, root access, and lateral movement. CISA KEV deadline expires today.
Citrix Patches NetScaler Zero-Days CVE-2026-88771, -88772
Citrix patched CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway. CISA orders federal agencies to apply by September 30.
Citrix NetScaler: Two Unpatched RCEs Actively Exploited
Two unpatched RCEs in Citrix NetScaler ADC and Gateway are actively exploited in the wild. CVE IDs are pending assignment; Citrix expects patches by end of September 2026.
- CISA Sept. 12: Patch Cisco, Citrix, Fortinet Today
- Citrix NetScaler Auth Bypass Now Exploited in Wild
- PaperCut NG/MF Zero-Day Under Active Attack
- Patch by Friday: Citrix NetScaler CVE-2026-8452 in KEV
- Citrix Patches Critical NetScaler Auth Bypass
- Coca-Cola Confirms Fairlife Data Theft
- Anubis claims Fairlife hit, 1TB and Nutanix encrypted
- Sysdig: JADEPUFFER now ships EncForge, targets model weights
- BlueHammer Defender LPE Now Used in Ransomware
- FortiBleed Tied to INC and Lynx Ransomware Crews
- Sysdig: JADEPUFFER ran a full ransomware chain from one LLM
- Blackpoint: Avalon Bundles Theft, Wiper, CrownX
- DPRK npm Packages Impersonate a Rollup Polyfill
- Anubis Ransomware Exploits Citrix Bleed 2
- Citrix Bleed: A Memory Leak That Bypassed MFA
Known exploited Citrix vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-88779 Citrix NetScaler Memory Buffer Flaw Enables Denial-of-Service Attackswrite-up | [ HIGH ] | 7.5 | 11.4% | ||
| CVE-2026-88772 Citrix NetScaler ADC/Gateway RCE via Memory Buffer Mishandlingwrite-up | [ HIGH ] | — | 76.6% | ||
| CVE-2026-88771 Citrix NetScaler ADC/Gateway Unauthenticated RCE via Input Validation Flawwrite-up | [ HIGH ] | — | 81.9% | ||
| CVE-2026-19490 Critical authentication bypass in Citrix NetScaler ADC and Gatewaywrite-up | [ CRITICAL ] | 9.3 | 33.3% | ||
| CVE-2026-8452 Citrix NetScaler ADC and Gateway Memory Buffer Overflowwrite-up | [ CRITICAL ] | 9.8 | 1.0% | ||
| CVE-2026-3055 Citrix NetScaler Out-of-Bounds Read Vulnerability | [ CRITICAL ] | 9.8 | 91.5% | ||
| CVE-2025-7775 Citrix NetScaler Memory Overflow Vulnerability | [ CRITICAL ] | 9.8 | 20.7% | ||
| CVE-2024-8069 Citrix Session Recording Deserialization of Untrusted Data Vulnerability | [ HIGH ] | 8.0 | 18.2% | ||
| CVE-2024-8068 Citrix Session Recording Improper Privilege Management Vulnerability | [ HIGH ] | 8.0 | 3.5% | ||
| CVE-2025-5777 Citrix Bleed 2 — NetScaler ADC/Gateway memory-disclosure leaking session tokensransomware usewrite-up | [ HIGH ] | 7.5 | 100.0% | ||
| CVE-2025-6543 Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 10.4% | ||
| CVE-2023-6549 Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | [ HIGH ] | 8.2 | 57.6% | ||
| CVE-2023-6548 Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | [ MEDIUM ] | 5.5 | 3.2% | ||
| CVE-2023-4966 Citrix Bleed — NetScaler ADC and Gateway Sensitive Information Disclosureransomware usewrite-up | [ CRITICAL ] | 9.4 | 100.0% | ||
| CVE-2023-24489 Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | [ CRITICAL ] | 9.8 | 97.3% | ||
| CVE-2023-3519 Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.7% | ||
| CVE-2022-27518 Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | [ CRITICAL ] | 9.8 | 6.9% | ||
| CVE-2021-22941 Citrix ShareFile Improper Access Control Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 53.6% | ||
| CVE-2019-12991 Citrix SD-WAN and NetScaler Command Injection Vulnerability | [ HIGH ] | 8.8 | 74.1% | ||
| CVE-2019-12989 Citrix SD-WAN and NetScaler SQL Injection Vulnerability | [ CRITICAL ] | 9.8 | 95.0% | ||
| CVE-2017-6316 Citrix Multiple Products Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 73.0% | ||
| CVE-2020-8196 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | [ MEDIUM ] | 4.3 | 26.3% | ||
| CVE-2020-8195 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | [ MEDIUM ] | 6.5 | 33.0% | ||
| CVE-2020-8193 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | [ MEDIUM ] | 6.5 | 88.3% | ||
| CVE-2019-19781 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2019-13608 Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerabilityransomware use | [ HIGH ] | 7.5 | 30.0% | ||
| CVE-2019-11634 Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 8.1% |
Every Citrix CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Other Citrix CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-107406 Memory overflow in Citrix NetScaler ADC and Gateway SAML handlingwrite-up | [ CRITICAL ] | 9.5 | 1.9% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/citrix.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.