Are Citrix & NetScaler safe right now?
No new exploited flaws in the last 30 days, but 5 in the last 90. Make sure those updates are installed.
Exploited in the last 90 days
- NetScalerZero-dayCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- NetScalerZero-dayCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- NetScalerZero-dayCitrix NetScaler Improper Input Validation Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
- NetScalerA Citrix NetScaler login bypass has no workaround
What to do: Upgrade; Citrix says there's no workaround. If you can't upgrade right away, limit access to known IP addresses and require multi-factor sign-in.
Fixed in: 14.1-73.32; 13.1-63.21; FIPS 13.1-37.277
- NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Earlier exploited flaws
- Citrix NetScaler Out-of-Bounds Read Vulnerability Zero-day
- Citrix NetScaler Memory Overflow Vulnerability Zero-day
- Citrix Session Recording Deserialization of Untrusted Data Vulnerability
- Citrix Session Recording Improper Privilege Management Vulnerability
- Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
- Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability Zero-day
- Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability Zero-day
- Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Zero-day
- Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
- Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Zero-day
- Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability Zero-day
- Citrix ShareFile Improper Access Control Vulnerability
- Citrix SD-WAN and NetScaler Command Injection Vulnerability
- Citrix SD-WAN and NetScaler SQL Injection Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 6 | 4 |
| 2025 | 5 | 2 |
| 2024 | 2 | 2 |
| 2023 | 3 | 1 |
| 2022 | 5 | 1 |
Questions
Are Citrix & NetScaler safe right now?
No new exploited flaws in the last 30 days, but 5 in the last 90. Make sure those updates are installed. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Citrix & NetScaler vulnerabilities have been exploited?
27 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 7 of them used by ransomware.
Covers products matching citrix, netscaler. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.