{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Citrix vulnerabilities","home_page_url":"https://patchfirst.co/vendor/citrix/","feed_url":"https://patchfirst.co/feed/vendor/citrix.json","description":"New and newly exploited Citrix CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-88779#kev","url":"https://patchfirst.co/cve/CVE-2026-88779/","title":"[KEV] CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-10-04. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application. Priority 72.4 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-10-04T00:00:00.000Z","date_modified":"2026-10-05T13:35:24.000Z","tags":["kev","T1190"],"_patchfirst":{"reason":"kev","priority":72.4,"kev":{"dateAdded":"2026-10-04","ransomware":false},"epss":{"score":0.11388,"percentile":0.95988},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2026-88771#kev","url":"https://patchfirst.co/cve/CVE-2026-88771/","title":"[KEV] CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 82.2% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Citrix NetScaler Improper Input Validation Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-29T04:18:01.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.8216,"percentile":0.99655},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-88772#kev","url":"https://patchfirst.co/cve/CVE-2026-88772/","title":"[KEV] CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","date_published":"2026-09-27T00:00:00.000Z","date_modified":"2026-09-28T12:26:47.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-27","ransomware":false},"epss":{"score":0.78162,"percentile":0.99577},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-19490#kev","url":"https://patchfirst.co/cve/CVE-2026-19490/","title":"[KEV] CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 32.7% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 79.5 of 100.","summary":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","date_published":"2026-09-09T00:00:00.000Z","date_modified":"2026-10-26T13:10:00.000Z","tags":["kev","public-exploit"],"_patchfirst":{"reason":"kev","priority":79.5,"kev":{"dateAdded":"2026-09-09","ransomware":false},"epss":{"score":0.32653,"percentile":0.9834},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-8452#kev","url":"https://patchfirst.co/cve/CVE-2026-8452/","title":"[KEV] CVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer…","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 72.5 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer…","date_published":"2026-08-26T00:00:00.000Z","date_modified":"2026-08-27T04:18:00.000Z","tags":["kev","public-exploit","T1190","T1499.004"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2026-08-26","ransomware":false},"epss":{"score":0.01011,"percentile":0.63147},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1190","T1499.004"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-3055#kev","url":"https://patchfirst.co/cve/CVE-2026-3055/","title":"[KEV] CVE-2026-3055: Citrix NetScaler Out-of-Bounds Read Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2026-03-30. ENISA EUVD lists it as exploited. EPSS 91.5% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.8 of 100.","summary":"Citrix NetScaler Out-of-Bounds Read Vulnerability","date_published":"2026-03-30T00:00:00.000Z","date_modified":"2026-06-17T10:42:58.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-03-30","ransomware":false},"epss":{"score":0.91491,"percentile":0.99812},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-7775#kev","url":"https://patchfirst.co/cve/CVE-2025-7775/","title":"[KEV] CVE-2025-7775: Citrix NetScaler Memory Overflow Vulnerability","content_text":"Citrix · NetScaler. In CISA KEV since 2025-08-26. ENISA EUVD lists it as exploited. EPSS 20.7% (higher than 97.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499 Endpoint Denial of Service. Priority 69.4 of 100.","summary":"Citrix NetScaler Memory Overflow Vulnerability","date_published":"2025-08-26T00:00:00.000Z","date_modified":"2026-06-17T10:05:38.000Z","tags":["kev","public-exploit","T1190","T1059","T1499"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-08-26","ransomware":false},"epss":{"score":0.2067,"percentile":0.97524},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler","techniqueIds":["T1190","T1059","T1499"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-8069#kev","url":"https://patchfirst.co/cve/CVE-2024-8069/","title":"[KEV] CVE-2024-8069: Citrix Session Recording Deserialization of Untrusted Data Vulnerability","content_text":"Citrix · Session Recording. In CISA KEV since 2025-08-25. ENISA EUVD lists it as exploited. EPSS 21.1% (higher than 97.6% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 68.1 of 100.","summary":"Citrix Session Recording Deserialization of Untrusted Data Vulnerability","date_published":"2025-08-25T00:00:00.000Z","date_modified":"2026-06-17T08:21:48.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2025-08-25","ransomware":false},"epss":{"score":0.21089,"percentile":0.97575},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"Session Recording","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-8068#kev","url":"https://patchfirst.co/cve/CVE-2024-8068/","title":"[KEV] CVE-2024-8068: Citrix Session Recording Improper Privilege Management Vulnerability","content_text":"Citrix · Session Recording. In CISA KEV since 2025-08-25. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89.1% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 66.4 of 100.","summary":"Citrix Session Recording Improper Privilege Management Vulnerability","date_published":"2025-08-25T00:00:00.000Z","date_modified":"2026-06-17T08:21:48.000Z","tags":["kev","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":66.4,"kev":{"dateAdded":"2025-08-25","ransomware":false},"epss":{"score":0.03481,"percentile":0.89096},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"Session Recording","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-5777#kev","url":"https://patchfirst.co/cve/CVE-2025-5777/","title":"[KEV] CVE-2025-5777: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","content_text":"Citrix · NetScaler ADC and Gateway. In CISA KEV since 2025-07-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.1 of 100.","summary":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","date_published":"2025-07-10T00:00:00.000Z","date_modified":"2026-10-08T10:35:53.000Z","tags":["kev","ransomware","public-exploit","T1190","T1555"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2025-07-10","ransomware":true},"epss":{"score":0.99972,"percentile":0.99978},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and Gateway","techniqueIds":["T1190","T1555"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-6543#kev","url":"https://patchfirst.co/cve/CVE-2025-6543/","title":"[KEV] CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","content_text":"Citrix · NetScaler ADC and Gateway. In CISA KEV since 2025-06-30. ENISA EUVD lists it as exploited. EPSS 10.4% (higher than 95.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1498 Network Denial of Service; T1059 Command and Scripting Interpreter. Priority 69.0 of 100.","summary":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","date_published":"2025-06-30T00:00:00.000Z","date_modified":"2026-06-17T10:02:07.000Z","tags":["kev","public-exploit","T1498","T1059"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2025-06-30","ransomware":false},"epss":{"score":0.10433,"percentile":0.95731},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and Gateway","techniqueIds":["T1498","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-6549#kev","url":"https://patchfirst.co/cve/CVE-2023-6549/","title":"[KEV] CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2024-01-17. ENISA EUVD lists it as exploited. EPSS 57.6% (higher than 99.08% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1574 Hijack Execution Flow; T1499 Endpoint Denial of Service. Priority 68.1 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","date_published":"2024-01-17T00:00:00.000Z","date_modified":"2026-06-17T06:50:58.000Z","tags":["kev","public-exploit","T1574","T1499"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2024-01-17","ransomware":false},"epss":{"score":0.57633,"percentile":0.99082},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1574","T1499"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-6548#kev","url":"https://patchfirst.co/cve/CVE-2023-6548/","title":"[KEV] CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2024-01-17. ENISA EUVD lists it as exploited. EPSS 3.2% (higher than 88.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection. Priority 61.8 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","date_published":"2024-01-17T00:00:00.000Z","date_modified":"2026-06-17T06:50:58.000Z","tags":["kev","T1055"],"_patchfirst":{"reason":"kev","priority":61.8,"kev":{"dateAdded":"2024-01-17","ransomware":false},"epss":{"score":0.03191,"percentile":0.88083},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1055"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2023-4966#kev","url":"https://patchfirst.co/cve/CVE-2023-4966/","title":"[KEV] CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2023-10-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1574 Hijack Execution Flow; T1005 Data from Local System. Named in 1 threat report. Priority 82.1 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","date_published":"2023-10-18T00:00:00.000Z","date_modified":"2026-07-31T04:16:44.000Z","tags":["kev","ransomware","public-exploit","T1574","T1005"],"_patchfirst":{"reason":"kev","priority":82.1,"kev":{"dateAdded":"2023-10-18","ransomware":true},"epss":{"score":0.99999,"percentile":0.99997},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1574","T1005"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-24489#kev","url":"https://patchfirst.co/cve/CVE-2023-24489/","title":"[KEV] CVE-2023-24489: Citrix Content Collaboration ShareFile Improper Access Control Vulnerability","content_text":"Citrix · Content Collaboration. In CISA KEV since 2023-08-16. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.","summary":"Citrix Content Collaboration ShareFile Improper Access Control Vulnerability","date_published":"2023-08-16T00:00:00.000Z","date_modified":"2026-06-17T05:39:22.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.8,"kev":{"dateAdded":"2023-08-16","ransomware":false},"epss":{"score":0.97343,"percentile":0.99897},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Content Collaboration","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-3519#kev","url":"https://patchfirst.co/cve/CVE-2023-3519/","title":"[KEV] CVE-2023-3519: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","content_text":"Citrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2023-07-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1105 Ingress Tool Transfer; T1087.002 Domain Account. Named in 6 threat reports. Priority 89.9 of 100.","summary":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","date_published":"2023-07-19T00:00:00.000Z","date_modified":"2026-08-05T05:16:39.000Z","tags":["kev","ransomware","public-exploit","T1190","T1574","T1105","T1087.002"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2023-07-19","ransomware":true},"epss":{"score":0.99749,"percentile":0.99954},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","techniqueIds":["T1190","T1574","T1105","T1087.002"],"reportCount":6,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2023-3466","url":"https://patchfirst.co/cve/CVE-2023-3466/","title":"CVE-2023-3466: Reflected Cross-Site Scripting (XSS)","content_text":"Citrix · NetScaler ADC . Not in CISA KEV. EPSS 2.6% (higher than 85.5% of CVEs). CVSS 8.3 HIGH. Named in 1 threat report. Priority 64.1 of 100.","summary":"Reflected Cross-Site Scripting (XSS)","date_published":"2023-07-19T00:00:00.000Z","date_modified":"2024-10-21T21:09:28.000Z","tags":[],"_patchfirst":{"reason":"published","priority":64.1,"kev":null,"epss":{"score":0.02629,"percentile":0.85492},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC ","techniqueIds":[],"reportCount":1,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-3467","url":"https://patchfirst.co/cve/CVE-2023-3467/","title":"CVE-2023-3467: Privilege Escalation to root administrator (nsroot)","content_text":"Citrix · NetScaler ADC . Not in CISA KEV. EPSS 1.3% (higher than 70.5% of CVEs). CVSS 8.0 HIGH. Named in 1 threat report. Priority 60.9 of 100.","summary":"Privilege Escalation to root administrator (nsroot)","date_published":"2023-07-19T00:00:00.000Z","date_modified":"2024-10-24T17:43:49.000Z","tags":[],"_patchfirst":{"reason":"published","priority":60.9,"kev":null,"epss":{"score":0.01305,"percentile":0.70503},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"NetScaler ADC ","techniqueIds":[],"reportCount":1,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-24488","url":"https://patchfirst.co/cve/CVE-2023-24488/","title":"CVE-2023-24488: Cross site scripting","content_text":"Citrix · Citrix ADC and Citrix Gateway . Not in CISA KEV. EPSS 81.2% (higher than 99.63% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. Priority 64.2 of 100.","summary":"Cross site scripting","date_published":"2023-07-10T00:00:00.000Z","date_modified":"2024-10-25T19:51:19.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":64.2,"kev":null,"epss":{"score":0.81169,"percentile":0.99634},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Citrix ADC and Citrix Gateway ","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-27518#kev","url":"https://patchfirst.co/cve/CVE-2022-27518/","title":"[KEV] CVE-2022-27518: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC) and Gateway. In CISA KEV since 2022-12-13. ENISA EUVD lists it as exploited. EPSS 6.9% (higher than 94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 72.5 of 100.","summary":"Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability","date_published":"2022-12-13T00:00:00.000Z","date_modified":"2026-06-17T04:37:09.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":72.5,"kev":{"dateAdded":"2022-12-13","ransomware":false},"epss":{"score":0.06858,"percentile":0.94038},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC) and Gateway","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-27510","url":"https://patchfirst.co/cve/CVE-2022-27510/","title":"CVE-2022-27510: Unauthorized access to Gateway user capabilities","content_text":"Citrix · Citrix Gateway, Citrix ADC . Not in CISA KEV. EPSS 1.1% (higher than 66.1% of CVEs). CVSS 9.8 CRITICAL. Priority 66.4 of 100.","summary":"Unauthorized access to Gateway user capabilities","date_published":"2022-11-08T00:00:00.000Z","date_modified":"2025-05-01T19:37:47.000Z","tags":[],"_patchfirst":{"reason":"published","priority":66.4,"kev":null,"epss":{"score":0.01119,"percentile":0.66104},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Citrix Gateway, Citrix ADC ","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-22941#kev","url":"https://patchfirst.co/cve/CVE-2021-22941/","title":"[KEV] CVE-2021-22941: Citrix ShareFile Improper Access Control Vulnerability","content_text":"Citrix · ShareFile. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 53.6% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.7 of 100.","summary":"Citrix ShareFile Improper Access Control Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T03:38:04.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":79.7,"kev":{"dateAdded":"2022-03-25","ransomware":true},"epss":{"score":0.53585,"percentile":0.98992},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"ShareFile","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-12989#kev","url":"https://patchfirst.co/cve/CVE-2019-12989/","title":"[KEV] CVE-2019-12989: Citrix SD-WAN and NetScaler SQL Injection Vulnerability","content_text":"Citrix · SD-WAN and NetScaler. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 95.0% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Citrix SD-WAN and NetScaler SQL Injection Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:15:52.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.94957,"percentile":0.9986},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"SD-WAN and NetScaler","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-6316#kev","url":"https://patchfirst.co/cve/CVE-2017-6316/","title":"[KEV] CVE-2017-6316: Citrix Multiple Products Remote Code Execution Vulnerability","content_text":"Citrix · NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 73.0% (higher than 99.45% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"Citrix Multiple Products Remote Code Execution Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T01:22:08.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.7303,"percentile":0.99454},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-12991#kev","url":"https://patchfirst.co/cve/CVE-2019-12991/","title":"[KEV] CVE-2019-12991: Citrix SD-WAN and NetScaler Command Injection Vulnerability","content_text":"Citrix · SD-WAN and NetScaler. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 74.5% (higher than 99.49% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 69.1 of 100.","summary":"Citrix SD-WAN and NetScaler Command Injection Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:15:52.000Z","tags":["kev","public-exploit","T1190"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.7446,"percentile":0.99493},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"SD-WAN and NetScaler","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-19781#kev","url":"https://patchfirst.co/cve/CVE-2019-19781/","title":"[KEV] CVE-2019-19781: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery. Named in 8 threat reports. Priority 89.9 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","public-exploit","T1133","T1059","T1083"],"_patchfirst":{"reason":"kev","priority":89.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99999,"percentile":0.99998},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1133","T1059","T1083"],"reportCount":8,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-13608#kev","url":"https://patchfirst.co/cve/CVE-2019-13608/","title":"[KEV] CVE-2019-13608: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","content_text":"Citrix · StoreFront Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.0% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts. Priority 77.9 of 100.","summary":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:17:04.000Z","tags":["kev","ransomware","public-exploit","T1059","T1003","T1005","T1046","T1078"],"_patchfirst":{"reason":"kev","priority":77.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.30041,"percentile":0.98206},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Citrix","product":"StoreFront Server","techniqueIds":["T1059","T1003","T1005","T1046","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11634#kev","url":"https://patchfirst.co/cve/CVE-2019-11634/","title":"[KEV] CVE-2019-11634: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","content_text":"Citrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.","summary":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-08-12T05:17:21.000Z","tags":["kev","ransomware","T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"_patchfirst":{"reason":"kev","priority":77.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.08091,"percentile":0.94808},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Citrix","product":"Workspace Application and Receiver for Windows","techniqueIds":["T1190","T1059","T1003","T1005","T1046","T1078","T1486"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2020-8195#kev","url":"https://patchfirst.co/cve/CVE-2020-8195/","title":"[KEV] CVE-2020-8195: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1005 Data from Local System; T1082 System Information Discovery. Priority 77.2 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:01.000Z","tags":["kev","public-exploit","T1056","T1005","T1082"],"_patchfirst":{"reason":"kev","priority":77.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.33029,"percentile":0.98359},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1005","T1082"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8196#kev","url":"https://patchfirst.co/cve/CVE-2020-8196/","title":"[KEV] CVE-2020-8196: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 26.3% (higher than 98% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1082 System Information Discovery; T1005 Data from Local System. Priority 75.6 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:02.000Z","tags":["kev","public-exploit","T1056","T1082","T1005"],"_patchfirst":{"reason":"kev","priority":75.6,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.26333,"percentile":0.98003},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1056","T1082","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-8193#kev","url":"https://patchfirst.co/cve/CVE-2020-8193/","title":"[KEV] CVE-2020-8193: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability","content_text":"Citrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1556 Modify Authentication Process; T1005 Data from Local System. Priority 67.5 of 100.","summary":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:26:01.000Z","tags":["kev","public-exploit","T1556","T1005"],"_patchfirst":{"reason":"kev","priority":67.5,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.88269,"percentile":0.99768},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","techniqueIds":["T1556","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}