Citrix — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Citrix with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 27 Citrix vulnerabilities confirmed as exploited in the wild across 12 products; 7 of them (26%) are flagged as used in known ransomware campaigns. NetScaler is the most-affected product, with 6 entries (22% of the total). CISA added 6 entries in 2026 so far, compared with 5 in 2025. Across the 27 entries with an NVD CVSS score (100% of the total), the average score is 8.6; 15 entries are rated critical by NVD. The most recent addition is CVE-2026-88779 (Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability), added on 2026-10-04.
Affected products
| Product | Entries | Share |
|---|---|---|
| NetScaler | 6 | 22% |
| NetScaler ADC and NetScaler Gateway | 5 | 19% |
| Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 4 | 15% |
| Session Recording | 2 | 7.4% |
| NetScaler ADC and Gateway | 2 | 7.4% |
| SD-WAN and NetScaler | 2 | 7.4% |
| Content Collaboration | 1 | 3.7% |
| Application Delivery Controller (ADC) and Gateway | 1 | 3.7% |
| ShareFile | 1 | 3.7% |
| NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | 1 | 3.7% |
| StoreFront Server | 1 | 3.7% |
| Workspace Application and Receiver for Windows | 1 | 3.7% |
Entries added per year
By date added to the KEV catalog
Exploited Citrix vulnerabilities (27)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-88779 | NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-10-04 | — | HIGH7.5 |
| CVE-2026-88772 | NetScaler | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-09-27 | — | HIGH8.1 |
| CVE-2026-88771 | NetScaler | Citrix NetScaler Improper Input Validation Vulnerability | 2026-09-27 | — | CRITICAL9.8 |
| CVE-2026-19490 | NetScaler | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | 2026-09-09 | — | CRITICAL9.8 |
| CVE-2026-8452 | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | 2026-08-26 | — | CRITICAL9.8 |
| CVE-2026-3055 | NetScaler | Citrix NetScaler Out-of-Bounds Read Vulnerability | 2026-03-30 | — | CRITICAL9.8 |
| CVE-2025-7775 | NetScaler | Citrix NetScaler Memory Overflow Vulnerability | 2025-08-26 | — | CRITICAL9.8 |
| CVE-2024-8068 | Session Recording | Citrix Session Recording Improper Privilege Management Vulnerability | 2025-08-25 | — | HIGH8.0 |
| CVE-2024-8069 | Session Recording | Citrix Session Recording Deserialization of Untrusted Data Vulnerability | 2025-08-25 | — | HIGH8.0 |
| CVE-2025-5777 | NetScaler ADC and Gateway | Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability | 2025-07-10 | Known | HIGH7.5 |
| CVE-2025-6543 | NetScaler ADC and Gateway | Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | 2025-06-30 | — | CRITICAL9.8 |
| CVE-2023-6549 | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 2024-01-17 | — | HIGH8.2 |
| CVE-2023-6548 | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | 2024-01-17 | — | MEDIUM5.5 |
| CVE-2023-4966 | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 2023-10-18 | Known | CRITICAL9.4 |
| CVE-2023-24489 | Content Collaboration | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | 2023-08-16 | — | CRITICAL9.8 |
| CVE-2023-3519 | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | 2023-07-19 | Known | CRITICAL9.8 |
| CVE-2022-27518 | Application Delivery Controller (ADC) and Gateway | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | 2022-12-13 | — | CRITICAL9.8 |
| CVE-2021-22941 | ShareFile | Citrix ShareFile Improper Access Control Vulnerability | 2022-03-25 | Known | CRITICAL9.8 |
| CVE-2019-12991 | SD-WAN and NetScaler | Citrix SD-WAN and NetScaler Command Injection Vulnerability | 2022-03-25 | — | HIGH8.8 |
| CVE-2019-12989 | SD-WAN and NetScaler | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2017-6316 | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Citrix Multiple Products Remote Code Execution Vulnerability | 2022-03-25 | — | CRITICAL9.8 |
| CVE-2019-13608 | StoreFront Server | Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability | 2021-11-03 | Known | HIGH7.5 |
| CVE-2020-8193 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | 2021-11-03 | — | MEDIUM6.5 |
| CVE-2020-8195 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 2021-11-03 | — | MEDIUM6.5 |
| CVE-2020-8196 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | 2021-11-03 | — | MEDIUM4.3 |
| CVE-2019-19781 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
| CVE-2019-11634 | Workspace Application and Receiver for Windows | Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability | 2021-11-03 | Known | CRITICAL9.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.