Citrix: exploited vulnerabilities
- 27exploited vulnerabilities
- 7used by ransomware
- Oct 4, 2026latest one added
- NetScaler 6
- NetScaler ADC and NetScaler Gateway 5
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance 4
- Session Recording 2
- NetScaler ADC and Gateway 2
- SD-WAN and NetScaler 2
- Content Collaboration 1
- Application Delivery Controller (ADC) and Gateway 1
- ShareFile 1
- NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server 1
- StoreFront Server 1
- Workspace Application and Receiver for Windows 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 4, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | High 8.7 | 11% |
| Sep 27, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Critical 9.5 | 78% |
| Sep 27, 2026 | Improper Input Validation | NetScaler | Critical 9.5 | 82% |
| Sep 9, 2026 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | Critical 9.3 | 33% |
| Aug 26, 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | High 8.8 | 1.0% |
| Mar 30, 2026 | Out-of-Bounds Read | NetScaler | Critical 9.3 | 91% |
| Aug 26, 2025 | Memory Overflow | NetScaler | Critical 9.2 | 21% |
| Aug 25, 2025 | Deserialization of Untrusted Data | Session Recording | Medium 5.1 | 21% |
| Aug 25, 2025 | Improper Privilege Management | Session Recording | Medium 5.1 | 3.5% |
| Jul 10, 2025 | Out-of-Bounds Read | NetScaler ADC and Gateway | Critical 9.3 | >99.9% |
| Jun 30, 2025 | Buffer Overflow | NetScaler ADC and Gateway | Critical 9.2 | 10% |
| Jan 17, 2024 | Buffer Overflow | NetScaler ADC and NetScaler Gateway | High 8.2 | 58% |
| Jan 17, 2024 | Code Injection | NetScaler ADC and NetScaler Gateway | Medium 5.5 | 3.2% |
| Oct 18, 2023 | Buffer Overflow | NetScaler ADC and NetScaler Gateway | Critical 9.4 | >99.9% |
| Aug 16, 2023 | ShareFile Improper Access Control | Content Collaboration | Critical 9.8 | 97% |
| Jul 19, 2023 | Code Injection | NetScaler ADC and NetScaler Gateway | Critical 9.8 | 99.7% |
| Dec 13, 2022 | Authentication Bypass | Application Delivery Controller (ADC) and Gateway | Critical 9.8 | 6.9% |
| Mar 25, 2022 | Improper Access Control | ShareFile | Critical 9.8 | 54% |
| Mar 25, 2022 | Command Injection | SD-WAN and NetScaler | High 8.8 | 74% |
| Mar 25, 2022 | SQL Injection | SD-WAN and NetScaler | Critical 9.8 | 95% |
| Mar 25, 2022 | Multiple Products Remote Code Execution | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | Critical 9.8 | 73% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 4.3 | 26% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 6.5 | 33% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Medium 6.5 | 88% |
| Nov 3, 2021 | ADC, Gateway, and SD-WAN WANOP Appliance Code Execution | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Critical 9.8 | >99.9% |
| Nov 3, 2021 | XML External Entity (XXE) Processing | StoreFront Server | High 7.5 | 30% |
| Nov 3, 2021 | Remote Code Execution | Workspace Application and Receiver for Windows | Critical 9.8 | 8.1% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.