https://patchfirst.co/vendor/citrix/New and newly exploited Citrix CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-88779/CVE-2026-88779#kevSun, 04 Oct 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-10-04. ENISA EUVD lists it as exploited. EPSS 11.4% (higher than 96% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application. Priority 72.4 of 100.kevT1190https://patchfirst.co/cve/CVE-2026-88771/CVE-2026-88771#kevSun, 27 Sep 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 82.2% (higher than 99.66% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-88772/CVE-2026-88772#kevSun, 27 Sep 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-09-27. ENISA EUVD lists it as exploited. EPSS 78.2% (higher than 99.58% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-19490/CVE-2026-19490#kevWed, 09 Sep 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-09-09. ENISA EUVD lists it as exploited. EPSS 32.7% (higher than 98.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 79.5 of 100.kevpublic-exploithttps://patchfirst.co/cve/CVE-2026-8452/CVE-2026-8452#kevWed, 26 Aug 2026 00:00:00 GMTCitrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2026-08-26. ENISA EUVD lists it as exploited. EPSS 1.0% (higher than 63.1% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 72.5 of 100.kevpublic-exploitT1190T1499.004https://patchfirst.co/cve/CVE-2026-3055/CVE-2026-3055#kevMon, 30 Mar 2026 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2026-03-30. ENISA EUVD lists it as exploited. EPSS 91.5% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 74.8 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2025-7775/CVE-2025-7775#kevTue, 26 Aug 2025 00:00:00 GMTCitrix · NetScaler. In CISA KEV since 2025-08-26. ENISA EUVD lists it as exploited. EPSS 20.7% (higher than 97.5% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1499 Endpoint Denial of Service. Priority 69.4 of 100.kevpublic-exploitT1190T1059T1499https://patchfirst.co/cve/CVE-2024-8069/CVE-2024-8069#kevMon, 25 Aug 2025 00:00:00 GMTCitrix · Session Recording. In CISA KEV since 2025-08-25. ENISA EUVD lists it as exploited. EPSS 21.1% (higher than 97.6% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 68.1 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2024-8068/CVE-2024-8068#kevMon, 25 Aug 2025 00:00:00 GMTCitrix · Session Recording. In CISA KEV since 2025-08-25. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89.1% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 66.4 of 100.kevpublic-exploitT1078T1068https://patchfirst.co/cve/CVE-2025-5777/CVE-2025-5777#kevThu, 10 Jul 2025 00:00:00 GMTCitrix · NetScaler ADC and Gateway. In CISA KEV since 2025-07-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1555 Credentials from Password Stores. Named in 1 threat report. Priority 82.1 of 100.kevransomwarepublic-exploitT1190T1555https://patchfirst.co/cve/CVE-2025-6543/CVE-2025-6543#kevMon, 30 Jun 2025 00:00:00 GMTCitrix · NetScaler ADC and Gateway. In CISA KEV since 2025-06-30. ENISA EUVD lists it as exploited. EPSS 10.4% (higher than 95.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1498 Network Denial of Service; T1059 Command and Scripting Interpreter. Priority 69.0 of 100.kevpublic-exploitT1498T1059https://patchfirst.co/cve/CVE-2023-6549/CVE-2023-6549#kevWed, 17 Jan 2024 00:00:00 GMTCitrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2024-01-17. ENISA EUVD lists it as exploited. EPSS 57.6% (higher than 99.08% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1574 Hijack Execution Flow; T1499 Endpoint Denial of Service. Priority 68.1 of 100.kevpublic-exploitT1574T1499https://patchfirst.co/cve/CVE-2023-6548/CVE-2023-6548#kevWed, 17 Jan 2024 00:00:00 GMTCitrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2024-01-17. ENISA EUVD lists it as exploited. EPSS 3.2% (higher than 88.1% of CVEs). CVSS 8.8 HIGH. ATT&CK: T1055 Process Injection. Priority 61.8 of 100.kevT1055https://patchfirst.co/cve/CVE-2023-4966/CVE-2023-4966#kevWed, 18 Oct 2023 00:00:00 GMTCitrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2023-10-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1574 Hijack Execution Flow; T1005 Data from Local System. Named in 1 threat report. Priority 82.1 of 100.kevransomwarepublic-exploitT1574T1005https://patchfirst.co/cve/CVE-2023-24489/CVE-2023-24489#kevWed, 16 Aug 2023 00:00:00 GMTCitrix · Content Collaboration. In CISA KEV since 2023-08-16. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2023-3519/CVE-2023-3519#kevWed, 19 Jul 2023 00:00:00 GMTCitrix · NetScaler ADC and NetScaler Gateway. In CISA KEV since 2023-07-19, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1105 Ingress Tool Transfer; T1087.002 Domain Account. Named in 6 threat reports. Priority 89.9 of 100.kevransomwarepublic-exploitT1190T1574T1105T1087.002https://patchfirst.co/cve/CVE-2023-3466/CVE-2023-3466Wed, 19 Jul 2023 00:00:00 GMTCitrix · NetScaler ADC . Not in CISA KEV. EPSS 2.6% (higher than 85.5% of CVEs). CVSS 8.3 HIGH. Named in 1 threat report. Priority 64.1 of 100.https://patchfirst.co/cve/CVE-2023-3467/CVE-2023-3467Wed, 19 Jul 2023 00:00:00 GMTCitrix · NetScaler ADC . Not in CISA KEV. EPSS 1.3% (higher than 70.5% of CVEs). CVSS 8.0 HIGH. Named in 1 threat report. Priority 60.9 of 100.https://patchfirst.co/cve/CVE-2023-24488/CVE-2023-24488Mon, 10 Jul 2023 00:00:00 GMTCitrix · Citrix ADC and Citrix Gateway . Not in CISA KEV. EPSS 81.2% (higher than 99.63% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. Priority 64.2 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-27518/CVE-2022-27518#kevTue, 13 Dec 2022 00:00:00 GMTCitrix · Application Delivery Controller (ADC) and Gateway. In CISA KEV since 2022-12-13. ENISA EUVD lists it as exploited. EPSS 6.9% (higher than 94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 72.5 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-27510/CVE-2022-27510Tue, 08 Nov 2022 00:00:00 GMTCitrix · Citrix Gateway, Citrix ADC . Not in CISA KEV. EPSS 1.1% (higher than 66.1% of CVEs). CVSS 9.8 CRITICAL. Priority 66.4 of 100.https://patchfirst.co/cve/CVE-2021-22941/CVE-2021-22941#kevFri, 25 Mar 2022 00:00:00 GMTCitrix · ShareFile. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 53.6% (higher than 99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.7 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2019-12989/CVE-2019-12989#kevFri, 25 Mar 2022 00:00:00 GMTCitrix · SD-WAN and NetScaler. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 95.0% (higher than 99.86% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2017-6316/CVE-2017-6316#kevFri, 25 Mar 2022 00:00:00 GMTCitrix · NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 73.0% (higher than 99.45% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2019-12991/CVE-2019-12991#kevFri, 25 Mar 2022 00:00:00 GMTCitrix · SD-WAN and NetScaler. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 74.5% (higher than 99.49% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application. Priority 69.1 of 100.kevpublic-exploitT1190https://patchfirst.co/cve/CVE-2019-19781/CVE-2019-19781#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1083 File and Directory Discovery. Named in 8 threat reports. Priority 89.9 of 100.kevransomwarepublic-exploitT1133T1059T1083https://patchfirst.co/cve/CVE-2019-13608/CVE-2019-13608#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · StoreFront Server. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 30.0% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts. Priority 77.9 of 100.kevransomwarepublic-exploitT1059T1003T1005T1046T1078https://patchfirst.co/cve/CVE-2019-11634/CVE-2019-11634#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Workspace Application and Receiver for Windows. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 8.1% (higher than 94.8% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1005 Data from Local System; T1046 Network Service Discovery; T1078 Valid Accounts; +1 more. Named in 1 threat report. Priority 77.7 of 100.kevransomwareT1190T1059T1003T1005T1046T1078T1486https://patchfirst.co/cve/CVE-2020-8195/CVE-2020-8195#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 33.0% (higher than 98.4% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1005 Data from Local System; T1082 System Information Discovery. Priority 77.2 of 100.kevpublic-exploitT1056T1005T1082https://patchfirst.co/cve/CVE-2020-8196/CVE-2020-8196#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 26.3% (higher than 98% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. ATT&CK: T1056 Input Capture; T1082 System Information Discovery; T1005 Data from Local System. Priority 75.6 of 100.kevpublic-exploitT1056T1082T1005https://patchfirst.co/cve/CVE-2020-8193/CVE-2020-8193#kevWed, 03 Nov 2021 00:00:00 GMTCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 88.3% (higher than 99.77% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1556 Modify Authentication Process; T1005 Data from Local System. Priority 67.5 of 100.kevpublic-exploitT1556T1005