Skip to main content
EVULNABLE
Home

Citrix

CVEs currently on EVULNABLE's Priority Feed for Citrix, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 2 added.

Week of 2026-04-20: 0 added to KEV Week of 2026-04-27: 0 added to KEV Week of 2026-05-04: 0 added to KEV Week of 2026-05-11: 0 added to KEV Week of 2026-05-18: 0 added to KEV Week of 2026-05-25: 0 added to KEV Week of 2026-06-01: 0 added to KEV Week of 2026-06-08: 0 added to KEV Week of 2026-06-15: 0 added to KEV Week of 2026-06-22: 0 added to KEV Week of 2026-06-29: 0 added to KEV Week of 2026-07-06: 0 added to KEV Week of 2026-07-13: 0 added to KEV Week of 2026-07-20: 0 added to KEV Week of 2026-07-27: 0 added to KEV Week of 2026-08-03: 0 added to KEV Week of 2026-08-10: 0 added to KEV Week of 2026-08-17: 0 added to KEV Week of 2026-08-24: 1 added to KEV Week of 2026-08-31: 0 added to KEV Week of 2026-09-07: 1 added to KEV Week of 2026-09-14: 0 added to KEV Week of 2026-09-21: 2 added to KEV Week of 2026-09-28: 1 added to KEV Week of 2026-10-05: 0 added to KEV Week of 2026-10-12 (so far): 0 added to KEV
2
0
May
Jun
Jul
Aug
Sep
Oct
  • Not ransomware-linked
  • Ransomware-linked
  • This week (so far)
CISA KEV additions per week, last 26 weeks
Week ofAdded to KEVRansomware-linked
2026-04-2000
2026-04-2700
2026-05-0400
2026-05-1100
2026-05-1800
2026-05-2500
2026-06-0100
2026-06-0800
2026-06-1500
2026-06-2200
2026-06-2900
2026-07-0600
2026-07-1300
2026-07-2000
2026-07-2700
2026-08-0300
2026-08-1000
2026-08-1700
2026-08-2410
2026-08-3100
2026-09-0710
2026-09-1400
2026-09-2120
2026-09-2810
2026-10-0500
2026-10-12 (so far)00

In EVULNABLE's ranked feed

Showing all 27 Citrix CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2019-19781 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.9% · 99.99th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#2 94 Immediate CVE-2025-5777 ExigentKEV since 2025 · listed over a yearRansomwareCISA KEV Citrix — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.3 (NVD)EPSS99.9% · 99.98th pctlKEV since2025-07-10

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#3 94 Immediate CVE-2023-3519 ExigentKEV since 2023 · listed over a yearRansomwareCISA KEV Citrix — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability KEV + ransomware, EPSS 99.7%

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS99.7% · 99.95th pctlKEV since2023-07-19

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#4 91 Immediate CVE-2023-4966 KEV since 2023 · listed over a yearRansomwareCISA KEV Citrix — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability KEV + ransomware, EPSS 99.9%

EVRS 91/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS99.9% · 99.99th pctlKEV since2023-10-18

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#5 86 Immediate CVE-2023-24489 ExigentKEV since 2023 · listed over a yearCISA KEV Citrix — Citrix Content Collaboration ShareFile Improper Access Control Vulnerability KEV, EPSS 97.3%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS97.3% · 99.9th pctlKEV since2023-08-16

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.973.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#6 86 Immediate CVE-2019-12989 ExigentKEV since 2022 · listed over a yearCISA KEV Citrix — Citrix SD-WAN and NetScaler SQL Injection Vulnerability KEV, EPSS 95.0%

EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS95.0% · 99.86th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.950.

Full CVE pageNVD ↗CISA KEV ↗
#7 85 Immediate CVE-2021-22941 ExigentKEV since 2022 · listed over a yearRansomwareCISA KEV Citrix — Citrix ShareFile Improper Access Control Vulnerability KEV + ransomware, EPSS 53.6%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS53.6% · 99th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#8 85 Immediate CVE-2019-11634 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV Citrix — Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability KEV + ransomware, EPSS 8.1%

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS8.1% · 94.8th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#9 80 Urgent CVE-2020-8193 KEV since 2021 · listed over a yearCISA KEV Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability KEV, EPSS 88.4%

EVRS 80/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS88.4% · 99.77th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.884.

Full CVE pageNVD ↗CISA KEV ↗
#10 80 Urgent CVE-2017-6316 KEV since 2022 · listed over a yearCISA KEV Citrix — Citrix Multiple Products Remote Code Execution Vulnerability KEV, EPSS 73.0%

EVRS 80/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS73.0% · 99.45th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.730.

Full CVE pageNVD ↗CISA KEV ↗
#11 79 Urgent CVE-2019-12991 KEV since 2022 · listed over a yearCISA KEV Citrix — Citrix SD-WAN and NetScaler Command Injection Vulnerability KEV, EPSS 74.1%

EVRS 79/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS74.1% · 99.48th pctlKEV since2022-03-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.741.

Full CVE pageNVD ↗CISA KEV ↗
#12 75 Urgent CVE-2023-6549 KEV since 2024 · listed over a yearCISA KEV Citrix — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability KEV, EPSS 57.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS57.6% · 99.08th pctlKEV since2024-01-17

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.576.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#13 75 Urgent CVE-2020-8195 KEV since 2021 · listed over a yearCISA KEV Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability KEV, EPSS 33.0%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS6.5 (NVD)EPSS33.0% · 98.3rd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.330.

Full CVE pageNVD ↗CISA KEV ↗
#14 75 Urgent CVE-2019-13608 KEV since 2021 · listed over a yearRansomwareCISA KEV Citrix — Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability KEV + ransomware, EPSS 30.0%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS30.0% · 98.2nd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE pageNVD ↗CISA KEV ↗
#15 75 Urgent CVE-2020-8196 KEV since 2021 · listed over a yearCISA KEV Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability KEV, EPSS 26.3%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS4.3 (NVD)EPSS26.3% · 98th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.263.

Full CVE pageNVD ↗CISA KEV ↗
#16 75 Urgent CVE-2026-19490 CISA federal deadline · Overdue by 34 daysCISA KEV Citrix — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability KEV, EPSS 23.2%, added to KEV within the last 90 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.3 (NVD)EPSS23.2% · 97.7th pctlKEV since2026-09-09

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.232.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#17 75 Urgent CVE-2025-7775 KEV since 2025 · listed over a yearCISA KEV Citrix — Citrix NetScaler Memory Overflow Vulnerability KEV, EPSS 20.3%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.2 (NVD)EPSS20.3% · 97.4th pctlKEV since2025-08-26

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.203.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#18 75 Urgent CVE-2024-8069 KEV since 2025 · listed over a yearCISA KEV Citrix — Citrix Session Recording Deserialization of Untrusted Data Vulnerability KEV, EPSS 14.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.1 (NVD)EPSS14.6% · 96.6th pctlKEV since2025-08-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.146.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#19 75 Urgent CVE-2025-6543 KEV since 2025 · listed over a yearCISA KEV Citrix — Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability KEV, EPSS 10.6%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.2 (NVD)EPSS10.6% · 95.7th pctlKEV since2025-06-30

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.106.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#20 75 Urgent CVE-2022-27518 KEV since 2022 · listed over a yearCISA KEV Citrix — Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability KEV, EPSS 6.9%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS6.9% · 94th pctlKEV since2022-12-13

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.069.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#21 75 Urgent CVE-2026-3055 CISA federal deadline · Overdue by 6 monthsCISA KEV Citrix — Citrix NetScaler Out-of-Bounds Read Vulnerability KEV, EPSS 4.0%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.3 (NVD)EPSS4.0% · 90.5th pctlKEV since2026-03-30

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.040.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#22 75 Urgent CVE-2024-8068 KEV since 2025 · listed over a yearCISA KEV Citrix — Citrix Session Recording Improper Privilege Management Vulnerability KEV, EPSS 3.5%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.1 (NVD)EPSS3.5% · 88.9th pctlKEV since2025-08-25

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.035.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#23 75 Urgent CVE-2023-6548 KEV since 2024 · listed over a yearCISA KEV Citrix — Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability KEV, EPSS 3.2%

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS3.2% · 87.9th pctlKEV since2024-01-17

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.032.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#24 75 Urgent CVE-2026-88772 CISA federal deadline · Overdue by 16 daysCISA KEV Citrix — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV, EPSS 1.3%, added to KEV within the last 30 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.5 (NVD)EPSS1.3% · 70th pctlKEV since2026-09-27

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.013.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#25 75 Urgent CVE-2026-88771 CISA federal deadline · Overdue by 16 daysCISA KEV Citrix — Citrix NetScaler Improper Input Validation Vulnerability KEV, EPSS 1.1%, added to KEV within the last 30 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.5 (NVD)EPSS1.1% · 64.6th pctlKEV since2026-09-27

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.011.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#26 75 Urgent CVE-2026-8452 CISA federal deadline · Overdue by 48 daysCISA KEV Citrix — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV, EPSS 1.0%, added to KEV within the last 90 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.8 (NVD)EPSS1.0% · 62.5th pctlKEV since2026-08-26

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.010.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗
#27 75 Urgent CVE-2026-88779 CISA federal deadline · Overdue by 9 daysCISA KEV Citrix — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV, EPSS 0.6%, added to KEV within the last 30 days

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS8.7 (NVD)EPSS0.6% · 47.2nd pctlKEV since2026-10-04

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.006.

Full CVE pageNVD ↗CISA KEV ↗Vendor Advisory ↗