Citrix: actively exploited vulnerabilities

Affected products

• NetScaler6
• NetScaler ADC and NetScaler Gateway5
• Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance4
• NetScaler ADC and Gateway2
• SD-WAN and NetScaler2
• Session Recording2
• Application Delivery Controller (ADC) and Gateway1
• Content Collaboration1
• NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server1
• ShareFile1
• StoreFront Server1
• Workspace Application and Receiver for Windows1

Our analyses

CybersecurityAlert level 4 of 5: Priority

NetScaler: Citrix patches new critical SAML-related flaw (CVE-2026-107406)

On October 8, Citrix released a patch for CVE-2026-107406, a flaw rated 9.5 out of 10 that affects NetScaler ADC and Gateway in SAML configurations. Citrix is not aware of any exploitation at this stage.

Oct 12, 20262 min read

CybersecurityAlert level 4 of 5: Priority

Citrix NetScaler zero-days exploited as CISA urges immediate patching

Two critical NetScaler ADC and Gateway vulnerabilities allow remote code execution and are being exploited worldwide. CISA's alert, updated on October 9, now covers ten CVEs.

Oct 11, 20261 min read

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

1. CERTFR-2026-AVI-1285Oct 9

   Vulnérabilité dans Citrix NetScaler ADC et Gateway (09 octobre 2026)

2. CERTFR-2026-AVI-1263Oct 5

   Vulnérabilité dans Citrix NetScaler ADC et Gateway (05 octobre 2026)

3. CERTFR-2026-ALE-011Sep 28

   Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway (28 septembre 2026)

4. CERTFR-2025-ALE-012Aug 26 2025

   Vulnérabilité dans Citrix NetScaler ADC et NetScaler Gateway (26 août 2025)

5. CERTFR-2025-ALE-009Jul 1 2025

   Multiples vulnérabilités dans Citrix NetScaler ADC et NetScaler Gateway (01 juillet 2025)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 6 vulnerabilities

1. CVE-2026-88779added Oct 4

   Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

   Mentioned in our article: NetScaler: Citrix patches new critical SAML-related flaw (CVE-2026-107406)

   NVD entryCISA catalog

2. CVE-2026-88772added Sep 27

   Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

   Mentioned in our article: NetScaler: Citrix patches new critical SAML-related flaw (CVE-2026-107406)

   NVD entryCISA catalog

3. CVE-2026-88771added Sep 27

   Citrix NetScaler Improper Input Validation Vulnerability

   Mentioned in our article: NetScaler: Citrix patches new critical SAML-related flaw (CVE-2026-107406)

   NVD entryCISA catalog

4. CVE-2026-19490added Sep 9

   Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

   NVD entryCISA catalog

5. CVE-2026-8452added Aug 26

   Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

   NVD entryCISA catalog

6. CVE-2026-3055added Mar 30

   Citrix NetScaler Out-of-Bounds Read Vulnerability

   NVD entryCISA catalog

2025 5 vulnerabilities

1. CVE-2025-7775added Aug 26 2025

   Citrix NetScaler Memory Overflow Vulnerability

   NVD entryCISA catalog

2. CVE-2024-8069added Aug 25 2025

   Citrix Session Recording Deserialization of Untrusted Data Vulnerability

   NVD entryCISA catalog

3. CVE-2024-8068added Aug 25 2025

   Citrix Session Recording Improper Privilege Management Vulnerability

   NVD entryCISA catalog

4. CVE-2025-5777Used by ransomwareadded Jul 10 2025

   Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

   NVD entryCISA catalog

5. CVE-2025-6543added Jun 30 2025

   Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

   NVD entryCISA catalog

2024 2 vulnerabilities

1. CVE-2023-6549added Jan 17 2024

   Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

   NVD entryCISA catalog

2. CVE-2023-6548added Jan 17 2024

   Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

   NVD entryCISA catalog

2023 3 vulnerabilities

1. CVE-2023-4966Used by ransomwareadded Oct 18 2023

   Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

   NVD entryCISA catalog

2. CVE-2023-24489added Aug 16 2023

   Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

   NVD entryCISA catalog

3. CVE-2023-3519Used by ransomwareadded Jul 19 2023

   Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

   NVD entryCISA catalog

2022 5 vulnerabilities

1. CVE-2022-27518added Dec 13 2022

   Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

   NVD entryCISA catalog

2. CVE-2021-22941Used by ransomwareadded Mar 25 2022

   Citrix ShareFile Improper Access Control Vulnerability

   NVD entryCISA catalog

3. CVE-2019-12991added Mar 25 2022

   Citrix SD-WAN and NetScaler Command Injection Vulnerability

   NVD entryCISA catalog

4. CVE-2019-12989added Mar 25 2022

   Citrix SD-WAN and NetScaler SQL Injection Vulnerability

   NVD entryCISA catalog

5. CVE-2017-6316added Mar 25 2022

   Citrix Multiple Products Remote Code Execution Vulnerability

   NVD entryCISA catalog

2021 6 vulnerabilities

1. CVE-2020-8196added Nov 3 2021

   Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

   NVD entryCISA catalog

2. CVE-2020-8195added Nov 3 2021

   Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

   NVD entryCISA catalog

3. CVE-2020-8193added Nov 3 2021

   Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

   NVD entryCISA catalog

4. CVE-2019-19781Used by ransomwareadded Nov 3 2021

   Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

   NVD entryCISA catalog

5. CVE-2019-13608Used by ransomwareadded Nov 3 2021

   Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

   NVD entryCISA catalog

6. CVE-2019-11634Used by ransomwareadded Nov 3 2021

   Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability

   NVD entryCISA catalog