16
CVEs
2
Critical
9
High
3
KEV
5
PoC
4
Unpatched C/H
68.8%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
9
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (30)
Xenserver
42
Netscaler Gateway Firmware
31
Netscaler Application Delivery Controller Firmware
29
Netscaler Gateway
28
Netscaler Application Delivery Controller
28
Application Delivery Controller Firmware
26
Xen
26
Debian Linux
20
Xenmobile Server
19
Sd Wan
18
Gateway
17
Netscaler Sd Wan
15
Gateway Firmware
13
Workspace
13
Netscaler
10
Sd Wan Wanop
9
Xendesktop
8
Sharefile Storagezones Controller
8
Ubuntu Linux
8
Virtual Apps And Desktops
8
Cloudportal Services Manager
8
Enterprise Linux Workstation
7
Xenapp
7
Netscaler Access Gateway
6
Enterprise Linux Server
6
Wireshark
6
Enterprise Linux Desktop
6
Netscaler Access Gateway Firmware
6
Provisioning Services
6
Open Redirect
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19490 | Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.1 before 63.21) allows remote attackers to access sensitive data over the network without credentials or user interaction. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with high impact to the vulnerable appliance; no public exploit identified at time of analysis and no CISA KEV listing is present in the provided data. Because NetScaler Gateway is typically internet-facing, exposed data such as session material could enable follow-on account or session takeover. | CRITICAL | 9.3 | 0.3% | 137 |
KEV
PoC
No patch
|
| CVE-2026-8452 | Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV. | HIGH | 8.8 | 0.4% | 119 |
KEV
PoC
|
| CVE-2026-3055 | An insufficient input validation vulnerability exists in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, allowing attackers to trigger a memory overread condition. The vulnerability affects both the NetScaler ADC and NetScaler Gateway products across multiple versions, and successful exploitation could lead to information disclosure by reading adjacent memory contents. While no CVSS score or EPSS data is currently published, the CWE-125 classification (Out-of-bounds Read) combined with the SAML IDP configuration context suggests moderate to high real-world risk for organizations relying on these devices for identity management. | CRITICAL | 9.3 | 0.0% | 117 |
KEV
PoC
|
| CVE-2026-8451 | Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the appliance is configured as a SAML identity provider (IDP), enabling disclosure of sensitive in-memory data such as tokens, session material, or other process memory. The CVSS 4.0 score of 8.8 reflects network-reachable, unauthenticated exploitation (PR:N) with high confidentiality and availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The flaw belongs to the same class of NetScaler appliance vulnerabilities (e.g., Citrix Bleed-style memory disclosure) that have historically drawn aggressive exploitation, making prompt patching advisable. | HIGH | 8.8 | 0.5% | 70 |
PoC
|
| CVE-2025-66391 | Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only permissions initiate privileged write workflows they should be barred from. Because the platform enforces authorization at the wrong step, a low-privilege operator can, for example, kick off a password-reset flow and have the one-time password delivered to an attacker-controlled email address, enabling takeover of other accounts. Publicly available exploit code exists (MITRE-reported, GitHub PoC), though there is no evidence of active exploitation and the EPSS probability is low at 0.38% (30th percentile). | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2026-19489 | Remote unauthenticated exploitation of NetScaler ADC and NetScaler Gateway allows attackers to cause high availability impact against the appliance alongside limited confidentiality and integrity compromise, without any privileges or user interaction. Affected builds span versions 13.1 through build 63.21 and 14.1 through build 73.32 for both products. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the combination of network-accessible attack vector with zero authentication barrier on widely deployed perimeter appliances warrants prompt remediation. | HIGH | 8.8 | 0.3% | 64 |
No patch
|
| CVE-2026-8655 | Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that produce unpredictable or erroneous behavior when the appliance is configured for specific DNS or load-balancing roles. Remote unauthenticated attackers can send crafted traffic to a vulnerable appliance to crash or destabilize it, with the CVSS 4.0 score of 8.8 driven primarily by high availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.8 | 0.4% | 49 |
|
| CVE-2026-13474 | Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive the appliance by sending malformed HTTP/2 requests, but only when HTTP/2 is enabled in the HTTP Profile and bound to an LB, CS, or VPN virtual server or service. The CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity loss, exploitable over the network without authentication or user interaction. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.7 | 0.4% | 49 |
|
| CVE-2026-53565 | Local privilege escalation in the Citrix Secure Access Client and Citrix Endpoint Analysis (EPA) Client for Windows allows a low-privileged local user to gain higher (likely SYSTEM-level) privileges through improper privilege management (CWE-269). It affects Secure Access Client for Windows before 26.6.1.20 and Endpoint Analysis Client for Windows before 26.5.1.7, both of which run privileged Windows service/agent components on the endpoint. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Citrix rates the flaw high severity (CVSS 4.0 base 8.5) given full confidentiality, integrity, and availability impact once exploited. | HIGH | 8.5 | 0.1% | 42 |
|
| CVE-2026-10816 | Arbitrary file read in Citrix NetScaler ADC and NetScaler Gateway lets unauthenticated attackers on an adjacent network retrieve sensitive files from the appliance when the NSIP, Cluster Management IP, or a SNIP has management access enabled. The flaw (CWE-73, external control of file name or path) carries a CVSS 4.0 base score of 7.1 with high confidentiality impact, and no public exploit identified at time of analysis. Exposure is gated by the management interface being reachable, which limits but does not eliminate risk given NetScaler's history of attacker targeting. | HIGH | 7.1 | 0.2% | 41 |
|
| CVE-2026-10817 | Memory overread in Citrix NetScaler ADC and NetScaler Gateway exposes low-confidence partial memory contents to unauthenticated remote attackers when TCP TimeStamp processing is triggered against a misconfigured or specifically configured TCP Profile. The vulnerability is rooted in insufficient input validation (CWE-125) within the TCP TimeStamp handling code path, affecting virtual servers of type Load Balancer, Content Switching, and VPN, as well as configured services. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, though the network-accessible, zero-privilege attack vector warrants prompt patching given NetScaler's broad enterprise deployment. | MEDIUM | 6.9 | 0.4% | 40 |
|
| CVE-2026-4368 | Citrix NetScaler ADC and Gateway instances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers are vulnerable to a race condition that enables authenticated attackers to hijack other users' sessions. An attacker with valid credentials can exploit timing-dependent conditions to cause session mixup between concurrent users, potentially gaining unauthorized access to sensitive resources or impersonating other authenticated users. No patch is currently available for this high-severity vulnerability. | HIGH | 7.7 | 0.0% | 39 |
No patch
|
| CVE-2026-53566 | Out-of-bounds read in Citrix Secure Access Client for Windows (all versions before 26.6.1.20) enables a local low-privileged attacker to read memory beyond an allocated buffer boundary, resulting in high confidentiality impact with no integrity or availability consequence. The CVSS 4.0 score of 6.8 reflects the local attack vector and low-privilege requirement, meaning an attacker must already hold a foothold on the endpoint. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis. | MEDIUM | 6.8 | 0.1% | 34 |
|
| CVE-2026-18751 | External control of file name or path (CWE-73) in Citrix WorkSpace App 2607 on macOS allows a local low-privileged attacker, with active user interaction, to manipulate file system paths and cause high integrity and availability impacts on the vulnerable system. The CVSS 4.0 vector confirms local access with low privileges and required user interaction, resulting in a medium severity score of 5.2. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity and availability impacts are rated High, indicating potential for significant data manipulation or denial of service on affected endpoints. | MEDIUM | 5.2 | 0.1% | 26 |
No patch
|
| CVE-2026-78546 | Out-of-bounds read (CWE-125) in Citrix Workspace App for Windows exposes local, low-privileged users to limited memory disclosure and partial availability impact across Current Release and both LTSR branches. An attacker with local access and a standard user account can trigger the defect without user interaction, potentially reading a small amount of process memory and causing intermittent instability. No active exploitation or public exploit code has been identified; the vendor-released patch addresses the issue across all three affected release trains. | MEDIUM | 4.8 | 0.1% | 24 |
|