# Citrix vulnerabilities Source: https://junglewise.ai/threats/vendors/citrix Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/citrix.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in Citrix: 6 in the last 7 days and 24 in the last 90 days, 30 of them critical and 27 exploited in the wild. The most recent, CVE-2026-107410, was published on 13 November 2026. 6 vulnerabilities in the last four weeks, down 40% on the four before (10). 0 critical against 3, 0 exploited in the wild against 3. 8 technologies have a page of their own. ## Counts - Last 7 days: 6 - Last 30 days: 6 - Last 90 days: 24 - All time: 67 (30 critical, 27 exploited in the wild) ## About Citrix Software company that develops virtualization, networking, and cloud computing products. ## Latest Citrix vulnerabilities - [CVE-2026-107410: Citrix NetScaler Push memory overflow](https://junglewise.ai/threats/cve-2026-107410-memory-overflow-in-netscaler-push-can-lead-to-unpredictable-or) (info, published 13 Nov 2026) - [CVE-2026-107409: Citrix NetScaler ADC memory corruption in DNS-over-HTTPS](https://junglewise.ai/threats/cve-2026-107409-memory-corruption-in-dns-over-https-doh-can-lead-to) (info, published 13 Nov 2026) - [CVE-2026-107408: Citrix NetScaler ADC memory corruption in DNS / DNS-over-HTTPS](https://junglewise.ai/threats/cve-2026-107408-memory-corruption-in-dns-dns-over-https-doh-can-lead-to) (info, published 13 Nov 2026) - [CVE-2026-107407: Citrix NetScaler ADC memory overflow in SMPP traffic](https://junglewise.ai/threats/cve-2026-107407-memory-overflow-in-smpp-traffic-can-lead-to-unpredictable-or) (info, published 13 Nov 2026) - [CVE-2026-120868: Citrix NetScaler ADC memory overflow in packet processing](https://junglewise.ai/threats/cve-2026-120868-memory-overflow-in-packet-processing-can-lead-to-unpredictable) (info, published 13 Nov 2026) - [CVE-2026-120869: Citrix NetScaler Console authentication bypass](https://junglewise.ai/threats/cve-2026-120869-an-unauthenticated-attacker-can-bypass-authentication-controls) (info, published 12 Nov 2026) - [CVE-2026-53564: Citrix UniconOS arbitrary file read and write](https://junglewise.ai/threats/cve-2026-53564-vulnerability-in-citrix-uniconos-leading-to-arbitrary-file-read) (info, published 13 Oct 2026) - [CVE-2026-53563: Citrix UniconOS persistent command execution](https://junglewise.ai/threats/cve-2026-53563-vulnerability-in-citrix-uniconos-leading-to-persistent-command) (info, published 13 Oct 2026) - [CVE-2026-84420: Citrix Workspace app for Windows out-of-bounds read](https://junglewise.ai/threats/cve-2026-84420-out-of-bounds-read-vulnerability-in-citirx-citrix-workspace-app) (info, published 13 Oct 2026) - [CVE-2026-84419: Citrix Workspace app for Windows out-of-bounds write](https://junglewise.ai/threats/cve-2026-84419-out-of-bounds-write-vulnerability-in-citrix-workspace-app-for) (info, published 13 Oct 2026) - [CVE-2026-53562: Citrix UniconOS link following vulnerability](https://junglewise.ai/threats/cve-2026-53562-improper-link-resolution-before-file-access-link-following) (info, published 13 Oct 2026) - [CVE-2026-93693: Citrix ShareFile Storage Zones Controller SSRF and unauthorized queue operations](https://junglewise.ai/threats/cve-2026-93693-in-progress-sharefile-storage-zones-controller-v5-12-6-and-below) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-107406: Citrix NetScaler ADC memory overflow in SAML](https://junglewise.ai/threats/cve-2026-107406-memory-overflow-vulnerability-leading-to-remote-code-execution) (info, published 8 Oct 2026) - [CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability](https://junglewise.ai/threats/cve-2026-88779-cisa-adds-one-known-exploited-vulnerability-to-catalog) (critical, exploited in the wild, CVSS 7.5, published 4 Oct 2026) - [CVE-2026-88778: Citrix NetScaler ADC predictable value generation](https://junglewise.ai/threats/cve-2026-88778-predictable-exact-value-from-previous-values-vulnerability-in) (info, published 27 Sep 2026) - [CVE-2026-88777: Citrix NetScaler ADC and Gateway memory overflow](https://junglewise.ai/threats/cve-2026-88777-memory-overflow-vulnerability-vulnerability-in-citrix-netscaler) (info, published 27 Sep 2026) - [CVE-2026-88776: Citrix NetScaler ADC memory overflow](https://junglewise.ai/threats/cve-2026-88776-memory-overflow-vulnerability-vulnerability-in-citrix-netscaler) (info, published 27 Sep 2026) - [CVE-2026-88775: Citrix NetScaler ADC memory overflow](https://junglewise.ai/threats/cve-2026-88775-memory-overflow-vulnerability-in-citrix-netscaler-adc-and-citrix) (info, published 27 Sep 2026) - [CVE-2026-88774: Citrix NetScaler ADC and Gateway feature policy bypass](https://junglewise.ai/threats/cve-2026-88774-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler) (info, published 27 Sep 2026) - [CVE-2026-88773: Citrix NetScaler ADC HTTP Request/Response smuggling](https://junglewise.ai/threats/cve-2026-88773-inconsistent-interpretation-of-http-requests-http-request) (info, published 27 Sep 2026) - [CVE-2026-88772: Citrix NetScaler ADC and Gateway remote code execution and denial of service](https://junglewise.ai/threats/cve-2026-88772-vulnerability-in-citrix-netscaler-adc-and-citrix-netscaler) (critical, exploited in the wild, published 27 Sep 2026) - [CVE-2026-88771: Citrix NetScaler ADC and Gateway improper input validation](https://junglewise.ai/threats/cve-2026-88771-improper-input-validation-vulnerability-in-citrix-netscaler-adc) (critical, exploited in the wild, published 27 Sep 2026) - [CVE-2026-19490: Citrix NetScaler authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-19490-citrix-netscaler-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 9.8, published 19 Aug 2026) - [CVE-2026-18751: Citrix WorkSpace App macOS arbitrary root file modification](https://junglewise.ai/threats/cve-2026-18751-citrix-workspace-app-macos-arbitrary-root-file-modification) (info, CVSS 5.2, published 18 Aug 2026) - [CVE-2026-53565: Citrix Secure Access Client improper privilege management](https://junglewise.ai/threats/cve-2026-53565-citrix-secure-access-client-improper-privilege-management) (info, CVSS 8.5, published 14 Jul 2026) ## Most severe Citrix vulnerabilities - [CVE-2026-3055: Citrix NetScaler out-of-bounds read in SAML IdP](https://junglewise.ai/threats/cve-2026-3055-citrix-netscaler-out-of-bounds-read-in-saml-idp) (critical, exploited in the wild, CVSS 9.8, published 30 Mar 2026) - [CVE-2026-19490: Citrix NetScaler authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-19490-citrix-netscaler-authentication-bypass-via-alternate-path) (critical, exploited in the wild, CVSS 9.8, published 19 Aug 2026) - [CVE-2025-7775: Citrix NetScaler memory overflow in ADC and Gateway](https://junglewise.ai/threats/cve-2025-7775-citrix-netscaler-memory-overflow-in-adc-and-gateway) (critical, exploited in the wild, CVSS 9.8, published 26 Aug 2025) - [CVE-2025-6543: Citrix NetScaler ADC and Gateway buffer overflow](https://junglewise.ai/threats/cve-2025-6543-citrix-netscaler-adc-and-gateway-buffer-overflow) (critical, exploited in the wild, CVSS 9.8, published 30 Jun 2025) - [CVE-2023-24489: Citrix Content Collaboration ShareFile Improper Access Control Vulnerability](https://junglewise.ai/threats/cve-2023-24489-citrix-content-collaboration-sharefile-improper-access-control) (critical, exploited in the wild, CVSS 9.8, published 16 Aug 2023) - [CVE-2023-3519: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability](https://junglewise.ai/threats/cve-2023-3519-citrix-netscaler-adc-and-netscaler-gateway-code-injection) (critical, exploited in the wild, CVSS 9.8, published 19 Jul 2023) - [CVE-2022-27518: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability](https://junglewise.ai/threats/cve-2022-27518-citrix-application-delivery-controller-adc-and-gateway) (critical, exploited in the wild, CVSS 9.8, published 13 Dec 2022) - [CVE-2017-6316: Citrix Multiple Products Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2017-6316-citrix-multiple-products-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2021-22941: Citrix ShareFile Improper Access Control Vulnerability](https://junglewise.ai/threats/cve-2021-22941-citrix-sharefile-improper-access-control-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2019-12989: Citrix SD-WAN and NetScaler SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2019-12989-citrix-sd-wan-and-netscaler-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 40% on the four before (10). 0 critical against 3, 0 exploited in the wild against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 2 | 1 | 1 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 8 | 2 | 2 | | 28 Sep 2026 | 1 | 1 | 1 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 6 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 6 | 0 | 0 | ## Citrix technologies - [Citrix NetScaler Gateway](https://junglewise.ai/threats/technologies/gateway): 38 vulnerabilities - [Citrix NetScaler ADC](https://junglewise.ai/threats/technologies/netscaler-adc): 26 vulnerabilities - [Citrix XenServer](https://junglewise.ai/threats/technologies/xenserver): 11 vulnerabilities - [Citrix NetScaler](https://junglewise.ai/threats/technologies/netscaler): 8 vulnerabilities - [Citrix Application Delivery Controller (ADC)](https://junglewise.ai/threats/technologies/application-delivery-controller-adc): 5 vulnerabilities - [Citrix Provisioning Services](https://junglewise.ai/threats/technologies/provisioning-services): 5 vulnerabilities - [Citrix Sd-Wan Wanop Appliance](https://junglewise.ai/threats/technologies/sd-wan-wanop-appliance): 4 vulnerabilities - [Citrix UniconOS](https://junglewise.ai/threats/technologies/uniconos): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Citrix vulnerabilities", https://junglewise.ai/threats/vendors/citrix, 13 November 2026.