5
CVEs
1
Critical
1
High
1
KEV
1
PoC
2
Unpatched C/H
40.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
Xenserver
42
Netscaler Gateway Firmware
31
Netscaler Application Delivery Controller Firmware
29
Netscaler Gateway
28
Netscaler Application Delivery Controller
28
Application Delivery Controller Firmware
26
Xen
26
Debian Linux
20
Xenmobile Server
19
Sd Wan
18
Gateway
17
Netscaler Sd Wan
15
Gateway Firmware
13
Workspace
13
Netscaler
10
Sd Wan Wanop
9
Xendesktop
8
Sharefile Storagezones Controller
8
Ubuntu Linux
8
Virtual Apps And Desktops
8
Cloudportal Services Manager
8
Enterprise Linux Workstation
7
Xenapp
7
Netscaler Access Gateway
6
Enterprise Linux Server
6
Wireshark
6
Enterprise Linux Desktop
6
Netscaler Access Gateway Firmware
6
Provisioning Services
6
Open Redirect
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19490 | Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.1 before 63.21) allows remote attackers to access sensitive data over the network without credentials or user interaction. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with high impact to the vulnerable appliance; no public exploit identified at time of analysis and no CISA KEV listing is present in the provided data. Because NetScaler Gateway is typically internet-facing, exposed data such as session material could enable follow-on account or session takeover. | CRITICAL | 9.3 | 0.3% | 137 |
KEV
PoC
No patch
|
| CVE-2026-19489 | Remote unauthenticated exploitation of NetScaler ADC and NetScaler Gateway allows attackers to cause high availability impact against the appliance alongside limited confidentiality and integrity compromise, without any privileges or user interaction. Affected builds span versions 13.1 through build 63.21 and 14.1 through build 73.32 for both products. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the combination of network-accessible attack vector with zero authentication barrier on widely deployed perimeter appliances warrants prompt remediation. | HIGH | 8.8 | 0.3% | 64 |
No patch
|
| CVE-2026-18751 | External control of file name or path (CWE-73) in Citrix WorkSpace App 2607 on macOS allows a local low-privileged attacker, with active user interaction, to manipulate file system paths and cause high integrity and availability impacts on the vulnerable system. The CVSS 4.0 vector confirms local access with low privileges and required user interaction, resulting in a medium severity score of 5.2. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity and availability impacts are rated High, indicating potential for significant data manipulation or denial of service on affected endpoints. | MEDIUM | 5.2 | 0.1% | 26 |
No patch
|
| CVE-2026-78546 | Out-of-bounds read (CWE-125) in Citrix Workspace App for Windows exposes local, low-privileged users to limited memory disclosure and partial availability impact across Current Release and both LTSR branches. An attacker with local access and a standard user account can trigger the defect without user interaction, potentially reading a small amount of process memory and causing intermittent instability. No active exploitation or public exploit code has been identified; the vendor-released patch addresses the issue across all three affected release trains. | MEDIUM | 4.8 | 0.1% | 24 |
|
| CVE-2026-78547 | Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings. | MEDIUM | 4.4 | 0.2% | 22 |
|