What’s Vulnerable › Products
Citrix NetScaler ADC vulnerabilities
40 known vulnerabilities, 13 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Check whether your Citrix NetScaler ADC version is affected
Exploited Citrix NetScaler ADC vulnerabilities
- CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-88772 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-88771 — Citrix NetScaler Improper Input Validation Vulnerability
- CVE-2026-19490 — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-8452 — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-3055 — Citrix NetScaler Out-of-Bounds Read Vulnerability
- CVE-2025-7775 — Citrix NetScaler Memory Overflow Vulnerability
- CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
- CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
- CVE-2023-6549 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- CVE-2023-6548 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- CVE-2023-4966 — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- CVE-2023-3519 — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Latest Citrix NetScaler ADC vulnerabilities
- CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 7.5) — exploited
- CVE-2026-88778 — TCP Initial Sequence Number (ISN) prediction (CVSS 7.5)
- CVE-2026-88777 — Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 9.8)
- CVE-2026-88776 — Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 9.8)
- CVE-2026-88775 — Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (CVSS 9.8)
- CVE-2026-88774 — Feature policy bypass due to improper HTTP URL based expression usage (CVSS 7.2)
- CVE-2026-88773 — HTTP Request Smuggling (CVSS 10.0)
- CVE-2026-88772 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 8.1) — exploited
- CVE-2026-88771 — Citrix NetScaler Improper Input Validation Vulnerability (CVSS 9.8) — exploited
- CVE-2026-19490 — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVSS 9.8) — exploited
- CVE-2026-8655 — Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service (CVSS 9.8)
- CVE-2026-8452 — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 9.8) — exploited
- CVE-2026-8451 — Insufficient input validation leading to memory overread (CVSS 7.5)
- CVE-2026-13474 — Denial of service via malformed HTTP/2 requests (CVSS 7.5)
- CVE-2026-10817 — Insufficient input validation leading to memory overread (CVSS 7.5)
- CVE-2026-10816 — Arbitrary File Read (Unauthenticated) (CVSS 7.5)
- CVE-2026-3055 — Citrix NetScaler Out-of-Bounds Read Vulnerability (CVSS 9.8) — exploited
- CVE-2025-7776 — Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service (CVSS 9.8)
- CVE-2025-7775 — Citrix NetScaler Memory Overflow Vulnerability (CVSS 9.8) — exploited
- CVE-2025-6543 — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability (CVSS 9.8) — exploited
- CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability (CVSS 7.5) — exploited
- CVE-2025-5349 — NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface (CVSS 8.8)
- CVE-2024-8535 — Authenticated user can access unintended user capabilities (CVSS 8.1)
- CVE-2024-8534 — Memory safety vulnerability leading to memory corruption and Denial of Service (CVSS 8.1)
- CVE-2024-5492 — Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites (CVSS 6.1)