citrix vulnerabilities

Products

• xenserver 50
• netscaler gateway 42
• netscaler application delivery controller 40
• netscaler gateway firmware 31
• application delivery controller firmware 30
• netscaler application delivery controller firmware 29
• gateway 19
• xenmobile server 19
• sd-wan 18
• netscaler sd-wan 16
• access gateway 14
• workspace 14
• gateway firmware 11
• metaframe 10
• netscaler 10
• sd-wan wanop 10
• metaframe presentation server 9
• virtual apps and desktops 9
• xen 9
• xenapp 9
• cloudportal services manager 8
• sharefile storagezones controller 8
• xendesktop 8
• netscaler access gateway 7
• netscaler access gateway firmware 7
• presentation server 7
• access essentials 6
• Citrix Workspace app for Windows 6
• nfuse 6
• provisioning services 6

Latest citrix CVEs

Newest publication first · page 1 of 17

1. CVE-2026-53564 Arbitrary file read and write

   Published 2026-10-13

   Medium·CVSS 5.1

   Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

2. CVE-2026-53563 Persistent Command Execution

   Published 2026-10-13

   Medium·CVSS 6.9

   Vulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.

3. CVE-2026-84419 Out-of-Bounds Write

   Published 2026-10-13

   Medium·CVSS 6.8

   Out-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR 2607 Hotfix 1, and before LTSR 2507 CU3 Hotfix 1.

4. CVE-2026-53562 Local Privilege Escalation

   Published 2026-10-13

   High·CVSS 8.5

   Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.

5. CVE-2026-88779 Memory overflow vulnerability leading to Denial of Service

   Published 2026-10-04

   High·CVSS 8.7 EPSS 11.4% CISA KEV added 2026-10-04 Exploited in the wild

   Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

6. CVE-2026-88778 TCP Initial Sequence Number (ISN) prediction

   Published 2026-09-27

   High·CVSS 8.8

   Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1...

7. CVE-2026-88777 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

   Published 2026-09-27

   High·CVSS 8.8

   Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading...

8. CVE-2026-88776 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

   Published 2026-09-27

   High·CVSS 8.8

   Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading...

9. CVE-2026-88775 Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

   Published 2026-09-27

   High·CVSS 8.8

   Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflo...

10. CVE-2026-88773 HTTP Request Smuggling

    Published 2026-09-27

    Critical·CVSS 9.3 EPSS 3.1% Framework module

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: be...

11. CVE-2026-88774 Feature policy bypass due to improper HTTP URL based expression usage

    Published 2026-09-27

    High·CVSS 7.0

    Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due...

12. CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

    Published 2026-09-27

    Critical·CVSS 9.5 EPSS 76.6% CISA KEV added 2026-09-27 Exploited in the wild Framework module

    Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or De...

13. CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands

    Published 2026-09-27

    Critical·CVSS 9.5 EPSS 81.9% CISA KEV added 2026-09-27 Exploited in the wild Framework module

    Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a...

14. CVE-2026-78547 Out-of-Bounds Write

    Published 2026-09-11

    Medium·CVSS 4.4

    Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release (CR), before 2507.1 LTSR CU3, and before LTSR 2607.

15. CVE-2026-19490 NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

    Published 2026-08-19

    Critical·CVSS 9.3 EPSS 33.3% CISA KEV added 2026-09-09 Exploited in the wild

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

16. CVE-2026-18751 Citrix Workspace App for Mac Security Bulletin for CVE-2026-18751

    Published 2026-08-18

    Medium·CVSS 5.2

    External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607.

17. CVE-2026-53566 Out-of-bounds memory read

    Published 2026-07-14

    Medium·CVSS 6.8

    Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.

18. CVE-2026-53565 Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges

    Published 2026-07-14

    High·CVSS 8.5

    Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.

19. CVE-2026-13474 Denial of service via malformed HTTP/2 requests

    Published 2026-06-30

    High·CVSS 8.7

    Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

20. CVE-2026-10817 Insufficient input validation leading to memory overread

    Published 2026-06-30

    Medium·CVSS 6.9

    Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

21. CVE-2026-10816 Arbitrary File Read (Unauthenticated)

    Published 2026-06-30

    High·CVSS 7.1

    Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

22. CVE-2026-8655 Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service

    Published 2026-06-30

    High·CVSS 8.8

    Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured...

23. CVE-2026-8452 Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service

    Published 2026-06-30

    High·CVSS 8.8 EPSS 1.0% CISA KEV added 2026-08-26 Exploited in the wild

    Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

24. CVE-2026-8451 Insufficient input validation leading to memory overread

    Published 2026-06-30

    High·CVSS 8.8

    Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

25. CVE-2026-3055 Insufficient input validation leading to memory overread

    Published 2026-03-23

    Critical·CVSS 9.3 EPSS 91.5% CISA KEV added 2026-03-30 Exploited in the wild

    Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.