Product by Citrix
Citrix NetScaler Application Delivery Controller (ADC)
40 known vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) (Citrix), 13 of them actively exploited (CISA KEV).
Key figures
40
Vulnerabilities
13
Actively exploited (KEV)
3
Used by ransomware
19
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-5777 | NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread In CISA KEVRansomwarealso in 3 other products | 7.5 | |
| Critical | CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability In CISA KEVRansomwarealso in 2 other products | 9.8 | |
| Critical | CVE-2023-4966 | Unauthenticated sensitive information disclosure In CISA KEVRansomwarealso in 2 other products | 9.4 | |
| Critical | CVE-2026-19490 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 In CISA KEValso in 5 other products | 9.8 | |
| Critical | CVE-2026-88771 | Citrix NetScaler Improper Input Validation Vulnerability In CISA KEValso in 7 other products | 9.8 | |
| Critical | CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service In CISA KEValso in 7 other products | 8.1 | |
| Critical | CVE-2025-7775 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service In CISA KEValso in 3 other products | 9.8 | |
| Critical | CVE-2025-6543 | Memory overflow vulnerability leading to unintended control flow and Denial of Service In CISA KEValso in 3 other products | 9.8 | |
| Critical | CVE-2026-3055 | Insufficient input validation leading to memory overread In CISA KEValso in 3 other products | 9.8 | |
| Critical | CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability In CISA KEValso in 2 other products | 8.2 | |
| Critical | CVE-2026-8452 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service In CISA KEValso in 6 other products | 9.8 | |
| Critical | CVE-2023-6548 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability In CISA KEValso in 2 other products | 5.5 | |
| Critical | CVE-2026-88779 | Memory overflow vulnerability leading to Denial of Service In CISA KEValso in 7 other products | 7.5 | |
| Critical | CVE-2025-7776 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service | 9.8 | |
| High | CVE-2025-5349 | NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface | 8.8 | |
| Critical | CVE-2026-88773 | HTTP Request Smuggling | 10.0 | |
| High | CVE-2023-3466 | Citrix NetScaler ADC: Improper Input Validation | 8.3 | |
| High | CVE-2018-5314 | Citrix NetScaler Gateway: Command Injection | 7.5 | |
| Critical | CVE-2026-8655 | NetScaler ADC: Denial of Service | 9.8 | |
| Critical | CVE-2026-88777 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | 9.8 | |
| Critical | CVE-2026-88776 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | 9.8 | |
| Critical | CVE-2026-88775 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service | 9.8 | |
| High | CVE-2023-3467 | Citrix NetScaler ADC: Improper Privilege Management | 8.0 | |
| High | CVE-2026-88778 | TCP Initial Sequence Number (ISN) prediction | 7.5 | |
| High | CVE-2026-13474 | Denial of service via malformed HTTP/2 requests | 7.5 |
News
- Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gatewaycsoonline,
- Citrix NetScaler security snafus get even worse amid more 0-day reportstheregister-security,
- Citrix warns of actively exploited NetScaler flaw days after zero-day patch rushcsoonline,
- New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offlinethehackernews,
- Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earliersecurityweek,
- Vulnérabilité dans Citrix NetScaler ADC et Gateway (05 octobre 2026)cert-fr,