CISA KEV + NVD
Citrix NetScaler flaws exploited in the wild
20 Citrix NetScaler vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
NetScaler ADC and NetScaler Gateway were sold as Citrix ADC and Citrix Gateway.
In numbers
- 20 exploited flaws, listed from 3 Nov 2021 to 4 Oct 2026
- 4 used in ransomware campaigns
- 10 scored critical by NVD
- 2 days: median gap between NVD publication and the KEV listing, leaving out the 4 listed on the catalog’s first day; 10 were listed within a week
All exploited Citrix NetScaler flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-88779Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler | 4 Oct 2026 | 4 Oct 2026same day or before NVD | 7.5 High | Vendor |
| CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler | 27 Sep 2026 | 27 Sep 2026same day or before NVD | 8.1 High | Vendor |
| CVE-2026-88771Citrix NetScaler Improper Input Validation Vulnerability | NetScaler | 27 Sep 2026 | 27 Sep 2026same day or before NVD | 9.8 Critical | Vendor |
| CVE-2026-19490Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | NetScaler | 19 Aug 2026 | 9 Sep 202621 days later | 9.8 Critical | Vendor |
| CVE-2026-8452Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | NetScaler ADC and NetScaler Gateway | 30 Jun 2026 | 26 Aug 202657 days later | 9.8 Critical | Vendor |
| CVE-2026-3055Citrix NetScaler Out-of-Bounds Read Vulnerability | NetScaler | 23 Mar 2026 | 30 Mar 20267 days later | 9.8 Critical | Vendor |
| CVE-2025-7775Citrix NetScaler Memory Overflow Vulnerability | NetScaler | 26 Aug 2025 | 26 Aug 2025same day or before NVD | 9.8 Critical | Vendor |
| CVE-2025-5777Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability | NetScaler ADC and Gateway | 17 Jun 2025 | 10 Jul 202523 days laterUsed in ransomware | 7.5 High | Vendor |
| CVE-2025-6543Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | NetScaler ADC and Gateway | 25 Jun 2025 | 30 Jun 20255 days later | 9.8 Critical | Vendor |
| CVE-2023-6549Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | NetScaler ADC and NetScaler Gateway | 17 Jan 2024 | 17 Jan 2024same day or before NVD | 7.5 High | Vendor |
| CVE-2023-6548Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | NetScaler ADC and NetScaler Gateway | 17 Jan 2024 | 17 Jan 2024same day or before NVD | 8.8 High | Vendor |
| CVE-2023-4966Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | NetScaler ADC and NetScaler Gateway | 10 Oct 2023 | 18 Oct 20238 days laterUsed in ransomware | 7.5 High | Vendor |
| CVE-2023-3519Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | NetScaler ADC and NetScaler Gateway | 19 Jul 2023 | 19 Jul 2023same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2022-27518Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | Application Delivery Controller (ADC) and Gateway | 13 Dec 2022 | 13 Dec 2022same day or before NVD | 9.8 Critical | Vendor |
| CVE-2019-12991Citrix SD-WAN and NetScaler Command Injection Vulnerability | SD-WAN and NetScaler | 16 Jul 2019 | 25 Mar 2022983 days later | 8.8 High | — |
| CVE-2019-12989Citrix SD-WAN and NetScaler SQL Injection Vulnerability | SD-WAN and NetScaler | 16 Jul 2019 | 25 Mar 2022983 days later | 9.8 Critical | — |
| CVE-2020-8196Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 10 Jul 2020 | 3 Nov 2021481 days later | 4.3 Medium | — |
| CVE-2020-8195Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 10 Jul 2020 | 3 Nov 2021481 days later | 6.5 Medium | — |
| CVE-2020-8193Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 10 Jul 2020 | 3 Nov 2021481 days later | 6.5 Medium | — |
| CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 27 Dec 2019 | 3 Nov 2021677 days laterUsed in ransomware | 9.8 Critical | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.