NetScaler ADC vulnerabilities | LiveThreat CVE Feed

Network Security

NetScaler ADC

by Citrix · last CVE Oct 4, 2026

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities69 In the news12 Timeline

Severity mix

Critical 17High 28Medium 12Low 0

Severity

All severities69 Critical17 High28 Medium12 Low0

Exploitation

On CISA KEV13 Exploited in the wild13

Watch

Add NetScaler ADC to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-6548 In wildKEV	8.8	3%	Jan 17	Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Affected: 13.0 before 13.0-92.21; 13.1 before 13.1-51.15; 14.1 before 14.1-12.35
CVE-2026-88772 In wildKEV	8.1	78%	Sep 27	Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP
CVE-2026-88779 In wildKEV	7.5	11%	Oct 4	Memory overflow vulnerability leading to Denial of Service Affected: 13.1 before 13.1-64.28; 14.1 before 14.1-73.41
CVE-2025-5777 RansomwareIn wildKEV	7.5	100%	Jun 17	NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-58.32; 14.1 before 14.1-43.56
CVE-2023-6549 In wildKEV	7.5	58%	Jan 17	Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability Affected: 13.0 before 13.0-92.21; 13.1 before 13.1-51.15; 14.1 before 14.1-12.35
CVE-2023-4966 RansomwareIn wildKEV	7.5	100%	Oct 10	Unauthenticated sensitive information disclosure Affected: 14.1 before 8.50; 13.1 before 49.15; 13.0 before 92.19
CVE-2025-5349	8.8	7%	Jun 17	Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway Affected: 12.1 before 12.1-55.328; 13.1 before 13.1-37.235; 13.1 before 13.1-37.235; 13.1 before 13.1-58.32; 14.1 before 14.1-43.56
CVE-2020-8247	8.8	1%	Sep 18	Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 13.0 before 13.0-64.35
CVE-2018-6186	8.8	3%	Feb 1	Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account Affected: 12.0
CVE-2024-8535	8.1	0%	Nov 12	Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP… Affected: 12.1 before 12.1-55.321; 12.1 before 12.1-55.321; 12.1 before 13.1-55.34; 13.1 before 13.1-37.207; 14.1 before 14.1-29.72
CVE-2024-8534	8.1	1%	Nov 12	Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP… Affected: 12.1 before 12.1-55.321; 12.1 before 12.1-55.321; 12.1 before 13.1-55.34; 13.1 before 13.1-37.207; 14.1 before 14.1-29.72
CVE-2021-22927	8.1	1%	Aug 5	A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session Affected: 11.1 before 11.1-65.22
CVE-2023-3467	8.0	1%	Jul 19	Privilege Escalation to root administrator (nsroot) Affected: 12.1 before 12.1-55.297; 12.1 before 12.1-55.297; 13.0 before 13.0-91.13; 13.1 before 13.1-37.159; 13.1 before 13.1-49.13; 11.1-65.22
CVE-2026-88778	7.5	1%	Sep 27	TCP Initial Sequence Number (ISN) prediction Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP
CVE-2026-13474	7.5	1%	Jun 30	Denial of service via malformed HTTP/2 requests Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61
CVE-2026-10817	7.5	1%	Jun 30	Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61
CVE-2026-10816	7.5	1%	Jun 30	Arbitrary File Read (Unauthenticated) Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61
CVE-2026-8451	7.5	1%	Jun 30	Insufficient input validation leading to memory overread Affected: 13.1 before 13.1-63.18; 14.1 before 14.1-72.61
CVE-2024-5491	7.5	1%	Jul 10	Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler Affected: 12.1 before 12.1-55.304; 12.1 before 12.1-55.304; 12.1 before 13.0-92.31; 13.1 before 13.1-37.183; 13.1 before 13.1-53.17; 14.1 before 14.1-25.53
CVE-2023-4967	7.5	1%	Oct 27	Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server Affected: 13.0 before 13.0-92.19; 13.1 before 13.1-49.15; 14.1 before 14.1-8.50; 12.1 through 12.1-55.300; 12.1 through 12.1-55.300; 13.1 through 13.1-37.164
CVE-2023-24487	7.5	1%	Jul 10	Arbitrary file read in Citrix ADC and Citrix Gateway Affected: 12.1 before 12.1-65.35; 13.0 before 13.0-90.11; 13.1 before 13.1-45.61
CVE-2022-27508	7.5	1%	Jan 26	Unauthenticated denial of service Affected: 12.1-64.16
CVE-2021-22956	7.5	1%	Dec 7	An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with… Affected: before 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-65.23
CVE-2021-22955	7.5	1%	Dec 7	A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (Gateway) or AAA virtual server could allow… Affected: before 11.1-65.23; 12.1 before 12.1-63.22; 13.0 before 13.0-83.27
CVE-2021-22919	7.5	1%	Aug 5	A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition… Affected: 11.1 before 11.1-65.22
CVE-2020-8246	7.5	2%	Sep 18	Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler… Affected: 11.1 before 11.1-65.12; 13.0 before 13.0-64.35
CVE-2018-5314	7.5	3%	Mar 1	Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load… Affected: 11.0; 11.1; 12.0
CVE-2026-88774	7.2	0%	Sep 27	Feature policy bypass due to improper HTTP URL based expression usage Affected: before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP