Exploited CVEs / By vendor / Citrix
Citrix vulnerabilities actively exploited
22 Citrix CVEs on the CISA Known Exploited Vulnerabilities catalog, newest first. Refreshed daily.
Every CVE below is confirmed exploited in the wild, not just theoretically severe. The newest addition is CVE-2026-3055 (NetScaler, added 2026-03-30). 7 of the 22 are used in ransomware campaigns. New CISA KEV entries appear here the day they are cataloged; the freshest across all vendors are on exploited this week.
Senserva AI Opinion and rich prompt for Citrix exploited CVEs
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
NetScaler ADC and NetScaler Gateway: 4 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2023-6548 | NetScaler ADC and NetScaler Gateway | 2024-01-17 | CVSS 8.8, EPSS 3% |
| CVE-2023-6549 | NetScaler ADC and NetScaler Gateway | 2024-01-17 | CVSS 7.5, EPSS 58% |
| CVE-2023-4966 | NetScaler ADC and NetScaler Gateway | 2023-10-18 | ransomware, CVSS 7.5, EPSS 100% |
| CVE-2023-3519 | NetScaler ADC and NetScaler Gateway | 2023-07-19 | ransomware, CVSS 9.8, EPSS 100% |
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance: 4 exploited CVEs
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2019-19781 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 2021-11-03 | ransomware, CVSS 9.8, EPSS 100% |
| CVE-2020-8193 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 2021-11-03 | CVSS 6.5, EPSS 88% |
| CVE-2020-8195 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 2021-11-03 | CVSS 6.5, EPSS 33% |
| CVE-2020-8196 | Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | 2021-11-03 | CVSS 4.3, EPSS 26% |
Other Citrix products
| CVE | Product | Added to KEV | Signals |
|---|---|---|---|
| CVE-2026-3055 | NetScaler | 2026-03-30 | CVSS 9.8, EPSS 84% |
| CVE-2025-7775 | NetScaler | 2025-08-26 | CVSS 9.8, EPSS 20% |
| CVE-2024-8068 | Session Recording | 2025-08-25 | CVSS 8.0, EPSS 1% |
| CVE-2024-8069 | Session Recording | 2025-08-25 | CVSS 8.0, EPSS 15% |
| CVE-2025-5777 | NetScaler ADC and Gateway | 2025-07-10 | ransomware, CVSS 7.5, EPSS 100% |
| CVE-2025-6543 | NetScaler ADC and Gateway | 2025-06-30 | CVSS 9.8, EPSS 10% |
| CVE-2023-24489 | Content Collaboration | 2023-08-16 | CVSS 9.8, EPSS 95% |
| CVE-2022-27518 | Application Delivery Controller (ADC) and Gateway | 2022-12-13 | CVSS 9.8, EPSS 7% |
| CVE-2017-6316 | NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server | 2022-03-25 | CVSS 9.8, EPSS 73% |
| CVE-2019-12989 | SD-WAN and NetScaler | 2022-03-25 | CVSS 9.8, EPSS 94% |
| CVE-2019-12991 | SD-WAN and NetScaler | 2022-03-25 | CVSS 8.8, EPSS 74% |
| CVE-2021-22941 | ShareFile | 2022-03-25 | ransomware, CVSS 9.8, EPSS 54% |
| CVE-2019-11634 | Workspace Application and Receiver for Windows | 2021-11-03 | ransomware, CVSS 9.8, EPSS 8% |
| CVE-2019-13608 | StoreFront Server | 2021-11-03 | ransomware, CVSS 7.5, EPSS 30% |
Common questions about exploited Citrix CVEs
Which Citrix vulnerabilities are actively exploited?
As of August 2026, 22 Citrix CVEs are on the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is confirmed. The most-listed products are NetScaler ADC and NetScaler Gateway (4), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4). 7 are linked to ransomware campaigns.
What is the newest exploited Citrix CVE?
CVE-2026-3055, affecting NetScaler, added to the CISA KEV catalog on 2026-03-30. This page refreshes daily, so the newest entry is always first in the table.
How urgent are these Citrix CVEs?
KEV listing is the strongest fix-first signal there is: it means confirmed exploitation, not a prediction. Patch these ahead of higher-CVSS issues that nobody is exploiting. Check the vendor advisory (linked below) for fixed versions and workarounds.
Can I ask my own AI about exploited Citrix CVEs?
Yes. This page includes a free copy-paste AI prompt carrying the newest Citrix KEV entries, with CVSS, EPSS, and ransomware context, into Claude, ChatGPT, or Copilot. The data is refreshed twice a day (5 AM and 3 PM US Central).
Authoritative references
All vendors, searchable with due dates and CSV export: the exploited-CVE tracker. Every vendor with a page: exploited by vendor.