Citrix
- Exploited flaws
- 27in 12 products
- Added to CISA's list in 2026
- 65 in 2025
- Used by ransomware
- 7of 27, says CISA
- Disclosure to CISA's list
- 8 daysmedian; 13 of 21 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2017 | 1 |
| 2018 | 0 |
| 2019 | 5 |
| 2020 | 3 |
| 2021 | 1 |
| 2022 | 1 |
| 2023 | 5 |
| 2024 | 2 |
| 2025 | 3 |
| 2026 | 6 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| NetScaler | 6 | 2025-08-26 | 2026-10-04 |
| NetScaler ADC and NetScaler Gateway | 5 | 2023-07-19 | 2026-08-26 |
| Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 4 | 2021-11-03 | 2021-11-03 |
| NetScaler ADC and Gateway | 2 | 2025-06-30 | 2025-07-10 |
| SD-WAN and NetScaler | 2 | 2022-03-25 | 2022-03-25 |
| Session Recording | 2 | 2025-08-25 | 2025-08-25 |
Latest on CISA's list
- Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Citrix NetScaler Improper Input Validation Vulnerability
- Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Citrix NetScaler Out-of-Bounds Read Vulnerability
- Citrix NetScaler Memory Overflow Vulnerability
- Citrix Session Recording Deserialization of Untrusted Data Vulnerability
- Citrix Session Recording Improper Privilege Management Vulnerability
- Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
In the news
No security story in the last 14 days named Citrix in its headline.
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.