[ Vendor · 32 CVEs ]
Citrix
CVEs affecting Citrix published in the last 30 days, plus any Citrix CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-53564 | 13 Oct 2026 | CVSS 5.1 | Citrix UniconOSVulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. | Fix |
| CVE-2026-53563 | 13 Oct 2026 | CVSS 6.9 | Citrix UniconOSVulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. | Fix |
| CVE-2026-84419 | 13 Oct 2026 | CVSS 6.8 | Citrix Workspace app for WindowsOut-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR… | Fix |
| CVE-2026-53562 | 13 Oct 2026 | CVSS 8.5 | Citrix UniconOSImproper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and… | Fix |
| CVE-2026-88779 | 4 Oct 2026 | CVSS 7.5 | Exploited denial of service flaw in NetScaler ADC and GatewayVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and… | ExploitedFix |
| CVE-2026-88771 | 27 Sep 2026 | CVSS 9.8 | Unauthenticated command execution in NetScaler ADC and GatewayImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before… | ExploitedFix |
| CVE-2026-88772 | 27 Sep 2026 | CVSS 8.1 | Memory flaw in NetScaler ADC and Gateway allows remote code executionVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37… | ExploitedFix |
| CVE-2026-19490 | 19 Aug 2026 | CVSS 9.8 | Citrix NetScaler Authentication Bypass Using an Alternate Path or ChannelVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1… | Exploited |
| CVE-2026-8452 | 30 Jun 2026 | CVSS 9.8 | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory BufferMemory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the… | Exploited |
| CVE-2026-3055 | 23 Mar 2026 | CVSS 9.8 | Citrix NetScaler Out-of-Bounds ReadInsufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread | Exploited |
| CVE-2025-7775 | 26 Aug 2025 | CVSS 9.8 | Citrix NetScaler Memory OverflowMemory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is… | Exploited |
| CVE-2025-6543 | 25 Jun 2025 | CVSS 9.8 | Citrix NetScaler ADC and Gateway Buffer OverflowMemory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as… | Exploited |
| CVE-2025-5777 | 17 Jun 2025 | CVSS 7.5 | Citrix NetScaler ADC and Gateway Out-of-Bounds ReadInsufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP… | Exploited |
| CVE-2024-8068 | 12 Nov 2024 | CVSS 8.0 | Citrix Session Recording Improper Privilege ManagementPrivilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows… | Exploited |
| CVE-2024-8069 | 12 Nov 2024 | CVSS 8.0 | Citrix Session Recording Deserialization of Untrusted DataLimited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user… | Exploited |
| CVE-2023-6549 | 17 Jan 2024 | CVSS 7.5 | Citrix NetScaler ADC and NetScaler Gateway Buffer OverflowImproper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of… | Exploited |
| CVE-2023-6548 | 17 Jan 2024 | CVSS 8.8 | Citrix NetScaler ADC and NetScaler Gateway Code InjectionImproper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP… | Exploited |
| CVE-2023-6548 | 17 Jan 2024 | CVSS 8.8 | Citrix NetScaler ADC and NetScaler Gateway Code InjectionImproper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP… | Exploited |
| CVE-2023-4966 | 10 Oct 2023 | CVSS 7.5 | Citrix NetScaler ADC and NetScaler Gateway Buffer OverflowSensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy)… | Exploited |
| CVE-2023-3519 | 19 Jul 2023 | CVSS 9.8 | Citrix NetScaler ADC and NetScaler Gateway Code InjectionUnauthenticated remote code execution | Exploited |
| CVE-2023-24489 | 10 Jul 2023 | CVSS 9.8 | Citrix Content Collaboration ShareFile Improper Access ControlA vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated… | Exploited |
| CVE-2022-27518 | 13 Dec 2022 | CVSS 9.8 | Citrix Application Delivery Controller (ADC) and Gateway Authentication BypassUnauthenticated remote arbitrary code execution | Exploited |
| CVE-2021-22941 | 23 Sep 2021 | CVSS 9.8 | Citrix ShareFile Improper Access ControlImproper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the… | Exploited |
| CVE-2020-8193 | 10 Jul 2020 | CVSS 6.5 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization BypassImproper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2020-8195 | 10 Jul 2020 | CVSS 6.5 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information DisclosureImproper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2020-8196 | 10 Jul 2020 | CVSS 4.3 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information DisclosureImproper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix… | Exploited |
| CVE-2019-19781 | 27 Dec 2019 | CVSS 9.8 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code ExecutionAn issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. | Exploited |
| CVE-2019-13608 | 29 Aug 2019 | CVSS 7.5 | Citrix StoreFront Server XML External Entity (XXE) ProcessingCitrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | Exploited |
| CVE-2019-12991 | 16 Jul 2019 | CVSS 8.8 | Citrix SD-WAN and NetScaler Command InjectionCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). | Exploited |
| CVE-2019-12989 | 16 Jul 2019 | CVSS 9.8 | Citrix SD-WAN and NetScaler SQL InjectionCitrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. | Exploited |
| CVE-2019-11634 | 22 May 2019 | CVSS 9.8 | Citrix Workspace Application and Receiver for Windows Remote Code ExecutionCitrix Workspace App before 1904 for Windows has Incorrect Access Control. | Exploited |
| CVE-2017-6316 | 20 Jul 2017 | CVSS 9.8 | Citrix Multiple Products Remote Code ExecutionCitrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie… | Exploited |