NA
Network Security
NetScaler ADC
On CISA KEVExploited in the wildRansomware-linked
69
CVEs
13
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 17High 28Medium 12Low 0
Watch
Add NetScaler ADC to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-88771 In wildKEV | 9.8 | Sep 27 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-19490 In wildKEV | 9.8 | Aug 19 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 Affected: 13.1 before 13.1-37.277; 13.1 before 13.1-37.277; 13.1 before 13.1-63.21; 14.1 before 14.1-73.32; 14.1-66.68 through 14.1-73.32 |
| CVE-2026-8452 In wildKEV | 9.8 | Jun 30 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61 |
| CVE-2026-3055 In wildKEV | 9.8 | Mar 23 | Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-62.23; 14.1 before 14.1-60.58 |
| CVE-2025-7775 In wildKEV | 9.8 | Aug 26 | Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service Affected: 13.1 before 13.1-59.22; 14.1 before 14.1-47.48 |
| CVE-2025-6543 In wildKEV | 9.8 | Jun 25 | Memory overflow vulnerability leading to unintended control flow and Denial of Service Affected: 13.1 before 13.1-59.19; 14.1 before 14.1-47.46 |
| CVE-2023-3519 RansomwareIn wildKEV | 9.8 | Jul 19 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Affected: 13.1 before 49.13; 13.0 before 91.13 |
| CVE-2023-6548 In wildKEV | 8.8 | Jan 17 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Affected: 13.0 before 13.0-92.21; 13.1 before 13.1-51.15; 14.1 before 14.1-12.35 |
| CVE-2026-88772 In wildKEV | 8.1 | Sep 27 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-88779 In wildKEV | 7.5 | Oct 4 | Memory overflow vulnerability leading to Denial of Service Affected: 13.1 before 13.1-64.28; 14.1 before 14.1-73.41 |
| CVE-2025-5777 RansomwareIn wildKEV | 7.5 | Jun 17 | NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-58.32; 14.1 before 14.1-43.56 |
| CVE-2023-6549 In wildKEV | 7.5 | Jan 17 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability Affected: 13.0 before 13.0-92.21; 13.1 before 13.1-51.15; 14.1 before 14.1-12.35 |
| CVE-2023-4966 RansomwareIn wildKEV | 7.5 | Oct 10 | Unauthenticated sensitive information disclosure Affected: 14.1 before 8.50; 13.1 before 49.15; 13.0 before 92.19 |
| CVE-2026-88773 | 10.0 | Sep 27 | HTTP Request Smuggling Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1-37.279 and NDcPP |
| CVE-2026-88777 | 9.8 | Sep 27 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-88776 | 9.8 | Sep 27 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-88775 | 9.8 | Sep 27 | Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-8655 | 9.8 | Jun 30 | Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service Affected: before 13.1-37.272; before 13.1-37.272; 13.1 before 13.1-63.18; 14.1 before 14.1-72.61; 14.1-66.68 |
| CVE-2025-7776 | 9.8 | Aug 26 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway… Affected: 12.1 before 12.1-55.330; 12.1 before 12.1-55.330; 13.1 before 13.1-37.241; 13.1 before 13.1-37.241; 13.1 before 13.1-59.22; 14.1 before 14.1-47.48 |
| CVE-2022-27516 | 9.8 | Nov 8 | User login brute force protection functionality bypass Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.47 |
| CVE-2022-27510 | 9.8 | Nov 8 | Unauthorized access to Gateway user capabilities Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.41 |
| CVE-2016-2071 | 9.8 | Feb 17 | Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, and 10.5.e before Build 59.1305.e allows… Affected: 10.5; 10.5e; 11.0; 10.5; 10.5e; 11.0 |
| CVE-2022-27513 | 9.6 | Nov 8 | Remote desktop takeover via phishing Affected: 12.1 before 12.1-65.21; 13.0 before 13.0-88.12; 13.1 before 13.1-33.41 |
| CVE-2025-5349 | 8.8 | Jun 17 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway Affected: 12.1 before 12.1-55.328; 13.1 before 13.1-37.235; 13.1 before 13.1-37.235; 13.1 before 13.1-58.32; 14.1 before 14.1-43.56 |
| CVE-2020-8247 | 8.8 | Sep 18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 13.0 before 13.0-64.35 |
| CVE-2018-6186 | 8.8 | Feb 1 | Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account Affected: 12.0 |
| CVE-2024-8535 | 8.1 | Nov 12 | Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP… Affected: 12.1 before 12.1-55.321; 12.1 before 12.1-55.321; 12.1 before 13.1-55.34; 13.1 before 13.1-37.207; 14.1 before 14.1-29.72 |
| CVE-2024-8534 | 8.1 | Nov 12 | Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP… Affected: 12.1 before 12.1-55.321; 12.1 before 12.1-55.321; 12.1 before 13.1-55.34; 13.1 before 13.1-37.207; 14.1 before 14.1-29.72 |
| CVE-2021-22927 | 8.1 | Aug 5 | A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session Affected: 11.1 before 11.1-65.22 |
| CVE-2023-3467 | 8.0 | Jul 19 | Privilege Escalation to root administrator (nsroot) Affected: 12.1 before 12.1-55.297; 12.1 before 12.1-55.297; 13.0 before 13.0-91.13; 13.1 before 13.1-37.159; 13.1 before 13.1-49.13; 11.1-65.22 |
| CVE-2026-88778 | 7.5 | Sep 27 | TCP Initial Sequence Number (ISN) prediction Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2026-13474 | 7.5 | Jun 30 | Denial of service via malformed HTTP/2 requests Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61 |
| CVE-2026-10817 | 7.5 | Jun 30 | Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61 |
| CVE-2026-10816 | 7.5 | Jun 30 | Arbitrary File Read (Unauthenticated) Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61 |
| CVE-2026-8451 | 7.5 | Jun 30 | Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61 |
| CVE-2024-5491 | 7.5 | Jul 10 | Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler Affected: 12.1 before 12.1-55.304; 12.1 before 12.1-55.304; 12.1 before 13.0-92.31; 13.1 before 13.1-37.183; 13.1 before 13.1-53.17; 14.1 before 14.1-25.53 |
| CVE-2023-4967 | 7.5 | Oct 27 | Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server Affected: 13.0 before 13.0-92.19; 13.1 before 13.1-49.15; 14.1 before 14.1-8.50; 12.1 through 12.1-55.300; 12.1 through 12.1-55.300; 13.1 through 13.1-37.164 |
| CVE-2023-24487 | 7.5 | Jul 10 | Arbitrary file read in Citrix ADC and Citrix Gateway Affected: 12.1 before 12.1-65.35; 13.0 before 13.0-90.11; 13.1 before 13.1-45.61 |
| CVE-2022-27508 | 7.5 | Jan 26 | Unauthenticated denial of service Affected: 12.1-64.16 |
| CVE-2021-22956 | 7.5 | Dec 7 | An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with… Affected: before 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-65.23 |
| CVE-2021-22955 | 7.5 | Dec 7 | A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow… Affected: before 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-83.27 |
| CVE-2021-22919 | 7.5 | Aug 5 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition… Affected: 11.1 before 11.1-65.22 |
| CVE-2020-8246 | 7.5 | Sep 18 | Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 13.0 before 13.0-64.35 |
| CVE-2018-5314 | 7.5 | Mar 1 | Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load… Affected: 11.0; 11.1; 12.0 |
| CVE-2026-88774 | 7.2 | Sep 27 | Feature policy bypass due to improper HTTP URL based expression usage Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| CVE-2022-27507 | 6.5 | Jan 26 | Authenticated denial of service Affected: 12.1 before 12.1-64.17; 13.0 before 13.0-85.19; 13.1 before 13.1-21.50 |
| CVE-2019-18177 | 6.5 | Dec 26 | In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint Affected: before 13.0-58.30 |
| CVE-2021-22920 | 6.5 | Aug 5 | A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition… Affected: 12.1-62.25; 13.0-82.42 |
| CVE-2020-8300 | 6.5 | Jun 16 | Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML… Affected: 11.1 before 11.1-65.20 |
| CVE-2020-8299 | 6.5 | Jun 16 | Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0,… Affected: 11.1 before 11.1-65.20 |