Vendor
Citrix
As of , 27 Citrix vulnerabilities are on CISA's list of exploited vulnerabilities, 7 of them used in ransomware campaigns; 6 were added in 2026. Patch first: CVE-2026-19490.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-19490Authentication Bypass Using an Alternate Path or Channel | Citrix NetScaler | Patch nowForensic triage required by CISA | 0.23 | ||
| 2 | CVE-2026-88772Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.01 | ||
| 3 | CVE-2026-88771Improper Input Validation | Citrix NetScaler | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.01 | ||
| 4 | CVE-2026-88779Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.01 | ||
| 5 | CVE-2023-4966Buffer Overflow | Citrix NetScaler ADC and NetScaler Gateway | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 6 | CVE-2023-3519Code Injection | Citrix NetScaler ADC and NetScaler Gateway | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 7 | CVE-2019-19781ADC, Gateway, and SD-WAN WANOP Appliance Code Execution | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 8 | CVE-2026-3055Out-of-Bounds Read | Citrix NetScaler | Patch this weekMetasploit module | 0.04 | ||
| 9 | CVE-2019-12989SQL Injection | Citrix SD-WAN and NetScaler | Patch this weekEPSS 0.95; verified Exploit-DB entry | 0.95 | ||
| 10 | CVE-2019-12991Command Injection | Citrix SD-WAN and NetScaler | Patch this weekEPSS 0.74; verified Exploit-DB entry | 0.74 | ||
| 11 | CVE-2025-5777Out-of-Bounds Read | Citrix NetScaler ADC and Gateway | Patch this weekRansomware use; EPSS 0.99 | 0.99 | ||
| 12 | CVE-2023-6549Buffer Overflow | Citrix NetScaler ADC and NetScaler Gateway | Patch this weekEPSS 0.58 | 0.58 | ||
| 13 | CVE-2023-24489ShareFile Improper Access Control | Citrix Content Collaboration | Patch this weekEPSS 0.97 | 0.97 | ||
| 14 | CVE-2017-6316Multiple Products Remote Code Execution | Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Patch this weekEPSS 0.73 | 0.73 | ||
| 15 | CVE-2020-8193ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Patch this weekEPSS 0.88 | 0.88 | ||
| 16 | CVE-2021-22941Improper Access Control | Citrix ShareFile | Patch this weekRansomware use; EPSS 0.54 | 0.54 | ||
| 17 | CVE-2019-13608XML External Entity (XXE) Processing | Citrix StoreFront Server | Patch this weekRansomware use | 0.30 | ||
| 18 | CVE-2019-11634Remote Code Execution | Citrix Workspace Application and Receiver for Windows | Patch this weekRansomware use | 0.08 | ||
| 19 | CVE-2020-8195ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Patch soon | 0.33 | ||
| 20 | CVE-2025-7775Memory Overflow | Citrix NetScaler | Patch soon | 0.20 | ||
| 21 | CVE-2020-8196ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Patch soon | 0.26 | ||
| 22 | CVE-2024-8069Deserialization of Untrusted Data | Citrix Session Recording | Patch soon | 0.15 | ||
| 23 | CVE-2025-6543Buffer Overflow | Citrix NetScaler ADC and Gateway | Patch soon | 0.11 | ||
| 24 | CVE-2022-27518Authentication Bypass | Citrix Application Delivery Controller (ADC) and Gateway | Patch soon | 0.07 | ||
| 25 | CVE-2024-8068Improper Privilege Management | Citrix Session Recording | Patch soon | 0.03 |
Products
- NetScaler6 entries
- NetScaler ADC and NetScaler Gateway5 entries
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance4 entries
- NetScaler ADC and Gateway2 entries
- SD-WAN and NetScaler2 entries
- Session Recording2 entries
- Application Delivery Controller (ADC) and Gateway1 entry
- Content Collaboration1 entry
- NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server1 entry
- ShareFile1 entry
- StoreFront Server1 entry
- Workspace Application and Receiver for Windows1 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 6 |
| 2022 | 5 |
| 2023 | 3 |
| 2024 | 2 |
| 2025 | 5 |
| 2026 | 6 |