312
CVEs
65
Critical
125
High
23
KEV
62
PoC
141
Unpatched C/H
26.6%
Patch Rate
7.6%
Avg EPSS
Severity Breakdown
CRITICAL
65
HIGH
125
MEDIUM
116
LOW
6
Monthly CVE Trend
Affected Products (30)
Xenserver
42
Netscaler Gateway Firmware
31
Netscaler Application Delivery Controller Firmware
29
Netscaler Gateway
28
Netscaler Application Delivery Controller
28
Application Delivery Controller Firmware
26
Xen
26
Debian Linux
20
Xenmobile Server
19
Sd Wan
18
Gateway
17
Netscaler Sd Wan
15
Gateway Firmware
13
Workspace
13
Netscaler
10
Sd Wan Wanop
9
Xendesktop
8
Sharefile Storagezones Controller
8
Ubuntu Linux
8
Virtual Apps And Desktops
8
Cloudportal Services Manager
8
Enterprise Linux Workstation
7
Xenapp
7
Netscaler Access Gateway
6
Enterprise Linux Server
6
Wireshark
6
Enterprise Linux Desktop
6
Netscaler Access Gateway Firmware
6
Provisioning Services
6
Open Redirect
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-19781 | Citrix Application Delivery Controller and Gateway contain a directory traversal vulnerability allowing unauthenticated remote code execution, known as 'Shitrix', that triggered a global exploitation crisis in January 2020. | CRITICAL | 9.8 | 94.4% | 238 |
KEV
PoC
No patch
|
| CVE-2023-3519 | Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in summer 2023, with thousands of appliances compromised before patches were applied. | CRITICAL | 9.8 | 93.8% | 238 |
KEV
PoC
No patch
|
| CVE-2014-6271 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 94.2% | 228 |
KEV
PoC
|
| CVE-2023-4966 | Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows remote unauthenticated attackers to leak memory contents, including valid session tokens, when the appliance is configured as a Gateway or AAA virtual server. This is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 94.35% (100th percentile), and leaked tokens enable session hijacking that bypasses multifactor authentication. | HIGH | 7.5 | 94.3% | 212 |
KEV
PoC
No patch
|
| CVE-2014-7169 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 90.1% | 209 |
KEV
PoC
|
| CVE-2017-6316 | Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | CRITICAL | 9.8 | 87.8% | 207 |
KEV
PoC
No patch
|
| CVE-2025-5777 | Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote unauthenticated attackers leak uninitialized memory contents - including session tokens and other secrets - from the appliance's login endpoint when it is deployed as a Gateway or AAA virtual server. Dubbed 'CitrixBleed 2,' it is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries an EPSS score of 69.81% (99th percentile), placing it among the most likely-to-be-exploited CVEs. Leaked tokens enable session hijacking and MFA bypass, effectively granting attacker access to authenticated VPN/gateway sessions. | CRITICAL | 9.3 | 69.8% | 186 |
KEV
PoC
|
| CVE-2012-0217 | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%. | HIGH | 7.2 | 88.0% | 159 |
PoC
No patch
|
| CVE-2026-19490 | Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.1 before 63.21) allows remote attackers to access sensitive data over the network without credentials or user interaction. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with high impact to the vulnerable appliance; no public exploit identified at time of analysis and no CISA KEV listing is present in the provided data. Because NetScaler Gateway is typically internet-facing, exposed data such as session material could enable follow-on account or session takeover. | CRITICAL | 9.3 | 0.3% | 137 |
KEV
PoC
No patch
|
| CVE-2017-17382 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 78.3%. | MEDIUM | 5.9 | 78.3% | 128 |
PoC
No patch
|
| CVE-2025-6543 | Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended control flow and denial of service when configured as VPN or AAA virtual server. KEV-listed with public PoC, this vulnerability paired with CVE-2025-5777 (memory overread) indicates a systemic weakness in NetScaler's VPN request processing that enables both data theft and remote code execution. | CRITICAL | 9.8 | 2.0% | 121 |
KEV
PoC
|
| CVE-2026-8452 | Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV. | HIGH | 8.8 | 0.4% | 119 |
KEV
PoC
|
| CVE-2026-3055 | An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, allowing attackers to trigger a memory overread condition. The vulnerability affects both the NetScaler ADC and NetScaler Gateway products across multiple versions, and successful exploitation could lead to information disclosure by reading adjacent memory contents. While no CVSS score or EPSS data is currently published, the CWE-125 classification (Out-of-bounds Read) combined with the SAML IDP configuration context suggests moderate to high real-world risk for organizations relying on these devices for identity management. | CRITICAL | 9.3 | 0.0% | 117 |
KEV
PoC
|
| CVE-2019-11634 | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 8.1% | 107 |
KEV
No patch
|
| CVE-2015-7705 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 31.0% and no vendor patch available. | CRITICAL | 9.8 | 31.0% | 80 |
No patch
|