The Uptime report

Uptime Report Research · Advisory Ledger

Citrix NetScaler Vulnerabilities 2026: 48 CVEs in 7 Bulletins, 28 of Them Published Today, and 6 on CISA’s Exploited List

As of November 12, 2026, Citrix NetScaler vulnerabilities 2026 total 48 ADC and Gateway CVEs across 7 security bulletins, and 28 of them arrived today in bulletin CTX697305. CISA has put 6 of the 48 on its Known Exploited Vulnerabilities list, each with a 3 day federal deadline. That is more CVEs than 2023, 2024 and 2025 combined (20). The fix today is 14.1-73.57 or 13.1-64.39.

New today, November 12, 2026. CTX697305 (Critical) fixes 28 CVEs in NetScaler ADC and Gateway: 9 score 9.0 or higher on CVSS v4.0, and CVE-2026-120868 needs no special configuration. Builds below 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 FIPS and NDcPP are affected. Citrix reports no exploitation, and none of the 28 was in CISA KEV catalog version 2026.11.10 or had an NVD record when we pulled both today. A separate bulletin, CTX697320, fixes CVE-2026-120869 (CVSS 9.4) in NetScaler Console 14.1 before 14.1-74.34.
48ADC and Gateway CVEs in 2026 bulletins
6of them in CISA KEV
4 daysmedian, bulletin to KEV listing in 2026
8minimum fixed 14.1 builds in 2026
0 of 62026 KEV entries flagged for ransomware use

Key findings

  1. Citrix has published 48 NetScaler ADC and Gateway CVEs in 2026, against 7 in 2023, 6 in 2024 and 7 in 2025.
  2. The November 12 bulletin alone carries 28 CVEs, 58% of the year’s total, and Citrix credits its own AI-assisted code analysis with finding several of them.
  3. 6 of the 48 are in CISA KEV. Their federal fix window is 3 days for every one, against 21 days for the 2023 entries.
  4. Time from bulletin to KEV listing ranged from 0 days (CVE-2026-88771 and CVE-2026-88772) to 57 days (CVE-2026-8452), with a median of 4.
  5. The minimum fixed 14.1 build changed 7 times after March 23 and 4 times after September 27, with gaps as short as 5 days.
  6. 14 of the 2026 CVEs need a Gateway, AAA or SAML configuration, the remote-access and single sign-on roles. 2 affect default configurations.
  7. None of the 6 2026 KEV entries carries the Known ransomware flag. 3 older NetScaler entries in this set do: CVE-2023-3519, CVE-2023-4966, CVE-2025-5777.

Is my NetScaler build patched?

Pick your branch and type the build shown by show ns version. The checker compares it with the minimum fixed build in every 2025 and 2026 ADC and Gateway bulletin, plus the October PHP advisory, exactly as Citrix printed them.

Rules built in: on 14.1, CTX696300 counts as fixed at 14.1-60.58 or later except build 14.1-66.54, the only build affected by CVE-2026-4368. 14.1-FIPS is not listed in bulletins before June 2026. The checker tests versions, not configuration, and it does not test NetScaler Console, SDX or Secure Access clients.

Fixed-build lookup table, every bulletin since 2023

Each row is one Citrix security bulletin for customer-managed NetScaler ADC and Gateway. A build is fixed for that bulletin if it is equal to or later than the build shown for its branch. Red rows include a CVE that CISA lists as exploited.

Published Bulletin CVEs In KEV 14.1 13.1 14.1-FIPS 13.1-FIPS, NDcPP Note
Nov 12, 2026 CTX697305 28 0 14.1-73.57 13.1-64.39 14.1-73.58 FIPS 13.1-37.293 28 CVEs; Citrix says several were found by AI-assisted code analysis
Oct 22, 2026 CTX697263 2 (PHP) 2 14.1-73.49 13.1-64.32 14.1-73.49 FIPS 13.1-37.286 PHP CVE-2026-109618 and 109619 (third party); builds as revised Oct 27
Oct 8, 2026 CTX697191 1 0 14.1-73.46 13.1-64.29 14.1-73.46 FIPS 13.1-37.283 SAML SP or IdP only; IdP only on 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28
Oct 3, 2026 CTX697174 1 1 14.1-73.41 13.1-64.28 14.1-73.41 FIPS 13.1-37.282 Changelog date is Pacific time; NVD and KEV show October 4
Sep 27, 2026 CTX697096 8 2 14.1-73.37 13.1-64.23 14.1-73.37 FIPS 13.1-37.279 CVE-2026-88778 also needs Enhanced ISN Generation enabled
Aug 19, 2026 CTX696939 2 1 14.1-73.32 13.1-63.21 14.1-73.32 FIPS 13.1-37.277 No changelog on the page; date is NVD publication
Jun 30, 2026 CTX696604 6 1 14.1-72.61 13.1-63.18 14.1-72.61 FIPS 13.1-37.272 CVE-2026-13474 also needs http2SmallWndTimeout set to 30 on non-strict HTTP profiles
Mar 23, 2026 CTX696300 2 1 14.1-60.58 13.1-62.23 not listed 13.1-37.262 CVE-2026-4368 affects only 14.1-66.54; fixed in 14.1-60.58 and 14.1-66.59 or later
Nov 11, 2025 CTX695486 1 0 14.1-56.73 13.1-60.32 not listed 13.1-37.250
Aug 26, 2025 CTX694938 3 1 14.1-47.48 13.1-59.22 not listed 13.1-37.241
Jun 25, 2025 CTX694788 1 1 14.1-47.46 13.1-59.19 not listed 13.1-37.236
Jun 17, 2025 CTX693420 2 1 14.1-43.56 13.1-58.32 not listed 13.1-37.235
Nov 12, 2024 CTX691608 2 0 14.1-29.72 13.1-55.34 not listed 13.1-37.207
Jul 9, 2024 CTX677944 2 0 14.1-25.53 13.1-53.17 not listed 13.1-37.183
Jan 16, 2024 CTX584986 2 2 14.1-12.35 13.1-51.15 not listed 13.1-37.176
Oct 10, 2023 CTX579459 2 1 14.1-8.50 13.1-49.15 not listed 13.1-37.164 Exploitation note added 2023-10-17
Jul 18, 2023 CTX561482 3 1 not listed 13.1-49.13 not listed 13.1-37.159
Jul 10, 2023 CTX477714 2 0 not listed 13.1-45.61 not listed 13.1-37.150 Changelog says 2023-05-09; CVEs were published 2023-07-10, which we use

Citrix-managed cloud services and Adaptive Authentication are patched by Cloud Software Group, according to each 2026 bulletin. Secure Private Access hybrid deployments that use NetScaler instances are affected and need the same builds.

The 2026 build ladder: 8 minimum fixed builds on 14.1

Figure 1. Minimum fixed NetScaler 14.1 build after each 2026 bulletin

Minimum fixed NetScaler 14.1 build, 202614.1-6014.1-6414.1-6814.1-7214.1-74Mar 2026May 2026Jul 2026Sep 2026Nov 2026CTX696300, Mar 23, 2026: minimum fixed 14.1 build 14.1-60.58. Exploited or in KEVMar 23: 14.1-60.58CTX696300CTX696604, Jun 30, 2026: minimum fixed 14.1 build 14.1-72.61. Exploited or in KEVJun 30: 14.1-72.61CTX696604CTX696939, Aug 19, 2026: minimum fixed 14.1 build 14.1-73.32. Exploited or in KEVAug 19: 14.1-73.32CTX696939CTX697096, Sep 27, 2026: minimum fixed 14.1 build 14.1-73.37. Exploited or in KEVCTX697174, Oct 3, 2026: minimum fixed 14.1 build 14.1-73.41. Exploited or in KEVCTX697191, Oct 8, 2026: minimum fixed 14.1 build 14.1-73.46CTX697263, Oct 27, 2026: minimum fixed 14.1 build 14.1-73.49. Exploited or in KEVCTX697305, Nov 12, 2026: minimum fixed 14.1 build 14.1-73.57Sep 27: 14.1-73.37 (CTX697096)Oct 3: 14.1-73.41 (CTX697174)Oct 8: 14.1-73.46 (CTX697191)Oct 27: 14.1-73.49 (CTX697263)Nov 12: 14.1-73.57 (CTX697305)Red: Citrix says exploits were observed, or CISA put a CVE from that bulletin (or the PHP advisory) in KEV.

In March the minimum safe 14.1 build was 14.1-60.58. Today it is 14.1-73.57. The intervals between required builds ran 99, 50, 39, 6, 5, 19, 16 days. The tightest stretch began September 27: Citrix shipped CTX697096 with two exploited zero days, then CTX697174 on October 3 and CTX697191 on October 8, so an admin who patched on September 27 was below the fixed build 6 days later. CISA’s alert, last revised October 9, says attackers may use CVE-2026-88779 to force a reboot that runs code planted earlier through CVE-2026-88771.

The PHP step comes from CTX697263. Citrix lists NetScaler ADC and Gateway as impacted by PHP flaws CVE-2026-109618 and CVE-2026-109619, and its October 27 revision names 14.1-73.49 and 13.1-64.32 as the fixes. CISA added both PHP CVEs to KEV on October 26. They are third-party flaws, so they are not in our count of 48.

Every 2026 NetScaler ADC and Gateway CVE

All 48 CVEs, newest first, with the CVSS v4.0 score Citrix printed in the bulletin. 20 have an NVD record; 3 of those still show Awaiting Analysis, and the 28 from today have none yet. Red rows are in KEV.

Bulletin date CVE Issue Precondition group CVSS v4.0, Citrix CWE Bulletin KEV added NVD status
Nov 12 CVE-2026-111349 Heap overflow in AppFW decompression Local access, logs, policies or AppFW 6.9 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111348 Authentication material written to httperror.log Local access, logs, policies or AppFW 6.9 CWE-532 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111345 Denial of service or reboot loop (local vector) Local access, logs, policies or AppFW 6.9 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111343 Overflow in an authentication request (local vector) Gateway or AAA virtual server 6.9 CWE-120 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120866 Out-of-bounds write in BGP routing Protocol LB, DNS, NAT, ALG or routing 7.7 CWE-787 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111346 Out-of-bounds write in HTTP/2 HTTP, TCP, TLS or DTLS settings 8.3 CWE-787 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120867 Memory overflow in TLS 1.3 ECH or SafeNet HSM HTTP, TCP, TLS or DTLS settings 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120865 Memory overflow in HTTP/3 (QUIC) Protocol LB, DNS, NAT, ALG or routing 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120863 Memory overflow in the management plane Management access (NSIP) 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120862 Memory overflow in SIP ALG and DNS logging Protocol LB, DNS, NAT, ALG or routing 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120861 Memory overflow in GSLB and geolocation Protocol LB, DNS, NAT, ALG or routing 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120860 Memory overflow in Diameter, SIP-TCP, MQTT, RADIUS LB Protocol LB, DNS, NAT, ALG or routing 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111347 Heap overflow in B64DECODE policy expressions Local access, logs, policies or AppFW 8.7 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111342 Overflow in LDAP authentication Gateway or AAA virtual server 8.7 CWE-120 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111341 Overflow in client-certificate authentication Auth actions (LDAP, email, cert, WebAuth) 8.7 CWE-120 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111340 Stack overflow in knowledge-based authentication Auth actions (LDAP, email, cert, WebAuth) 8.7 CWE-121 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107414 Heap overflow in WebAuth authentication Auth actions (LDAP, email, cert, WebAuth) 8.7 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107413 Heap overflow in SAML authentication SAML (IdP, SP or action) 8.7 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107411 Memory overflow in RTSP ALG Protocol LB, DNS, NAT, ALG or routing 8.7 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120868 Memory overflow in packet processing Any deployment, default config 9.3 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-120864 Memory overflow in ICA proxy Gateway or AAA virtual server 9.3 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-111344 Memory overflow in Endpoint Analysis (EPA) Gateway or AAA virtual server 9.3 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107415 Heap overflow in Email OTP authentication Auth actions (LDAP, email, cert, WebAuth) 9.3 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107410 Heap overflow in NetScaler Push Protocol LB, DNS, NAT, ALG or routing 9.3 CWE-122 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107409 Double free in DNS over HTTPS Protocol LB, DNS, NAT, ALG or routing 9.3 CWE-415 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107408 Memory corruption in DNS or DoH Protocol LB, DNS, NAT, ALG or routing 9.3 CWE-787 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107407 Memory overflow in SMPP traffic Protocol LB, DNS, NAT, ALG or routing 9.3 CWE-119 CTX697305 No Not in NVD yet
Nov 12 CVE-2026-107412 Multiple memory overflows on Gateway or AAA Gateway or AAA virtual server 9.5 CWE-119 CTX697305 No Not in NVD yet
Oct 8 CVE-2026-107406 Memory overflow on SAML, code execution or DoS SAML (IdP, SP or action) 9.5 CWE-119 CTX697191 No Awaiting Analysis
Oct 3 CVE-2026-88779 Memory overflow on SAML SP or IdP, denial of service SAML (IdP, SP or action) 8.7 CWE-119 CTX697174 Oct 4, 2026 Analyzed
Sep 27 CVE-2026-88774 Policy bypass via HTTP URL expressions Local access, logs, policies or AppFW 7.0 CWE-16 CTX697096 No Modified
Sep 27 CVE-2026-88778 TCP initial sequence number prediction HTTP, TCP, TLS or DTLS settings 8.8 CWE-342 CTX697096 No Analyzed
Sep 27 CVE-2026-88777 Memory overflow in non-HTTP L7 features (FTP, RTSP, DNS64, NAT64) Protocol LB, DNS, NAT, ALG or routing 8.8 CWE-119 CTX697096 No Modified
Sep 27 CVE-2026-88776 Memory overflow in Oracle LB Protocol LB, DNS, NAT, ALG or routing 8.8 CWE-119 CTX697096 No Modified
Sep 27 CVE-2026-88775 Memory overflow, denial of service Gateway or AAA virtual server 8.8 CWE-119 CTX697096 No Modified
Sep 27 CVE-2026-88773 HTTP request smuggling HTTP, TCP, TLS or DTLS settings 9.3 CWE-444 CTX697096 No Analyzed
Sep 27 CVE-2026-88772 Memory overflow in DTLS, code execution or DoS HTTP, TCP, TLS or DTLS settings 9.5 CWE-119 CTX697096 Sep 27, 2026 Analyzed
Sep 27 CVE-2026-88771 Unauthenticated command execution Any deployment, default config 9.5 CWE-20 CTX697096 Sep 27, 2026 Analyzed
Aug 19 CVE-2026-19489 Memory overflow in LSN SIP ALG Protocol LB, DNS, NAT, ALG or routing 8.8 CWE-119 CTX696939 No Awaiting Analysis
Aug 19 CVE-2026-19490 Authentication bypass via alternate path Gateway or AAA virtual server 9.3 CWE-288 CTX696939 Sep 9, 2026 Analyzed
Jun 30 CVE-2026-10817 Memory overread with TCP TimeStamp HTTP, TCP, TLS or DTLS settings 6.9 CWE-125 CTX696604 No Analyzed
Jun 30 CVE-2026-10816 Unauthenticated arbitrary file read Management access (NSIP) 7.1 CWE-73 CTX696604 No Analyzed
Jun 30 CVE-2026-13474 HTTP/2 denial of service HTTP, TCP, TLS or DTLS settings 8.7 CWE-401 CTX696604 No Analyzed
Jun 30 CVE-2026-8655 Memory overflows in Oracle LB, DNS proxy or resolver Protocol LB, DNS, NAT, ALG or routing 8.8 CWE-119 CTX696604 No Analyzed
Jun 30 CVE-2026-8452 Memory overflow, denial of service Gateway or AAA virtual server 8.8 CWE-119 CTX696604 Aug 26, 2026 Analyzed
Jun 30 CVE-2026-8451 Memory overread on SAML IdP SAML (IdP, SP or action) 8.8 CWE-125 CTX696604 No Analyzed
Mar 23 CVE-2026-4368 Race condition, user session mixup (14.1-66.54 only) Gateway or AAA virtual server 7.7 CWE-362 CTX696300 No Awaiting Analysis
Mar 23 CVE-2026-3055 Memory overread on SAML IdP SAML (IdP, SP or action) 9.3 CWE-125 CTX696300 Mar 30, 2026 Analyzed

Which configurations the 2026 CVEs need

Citrix lists a precondition for each CVE, and most do not apply to every appliance. We grouped them by the configuration the bulletin names.

Figure 2. 2026 NetScaler CVEs by the precondition Citrix lists

2026 NetScaler CVEs by preconditionAny deployment, default configAny deployment, default config: 1 CVEs from March to October bulletinsAny deployment, default config: 1 CVEs in the November 12 bulletin2Gateway or AAA virtual serverGateway or AAA virtual server: 4 CVEs from March to October bulletinsGateway or AAA virtual server: 5 CVEs in the November 12 bulletin9SAML (IdP, SP or action)SAML (IdP, SP or action): 4 CVEs from March to October bulletinsSAML (IdP, SP or action): 1 CVEs in the November 12 bulletin5Auth actions (LDAP, email, cert, WebAuth)Auth actions (LDAP, email, cert, WebAuth): 0 CVEs from March to October bulletinsAuth actions (LDAP, email, cert, WebAuth): 4 CVEs in the November 12 bulletin4HTTP, TCP, TLS or DTLS settingsHTTP, TCP, TLS or DTLS settings: 5 CVEs from March to October bulletinsHTTP, TCP, TLS or DTLS settings: 2 CVEs in the November 12 bulletin7Protocol LB, DNS, NAT, ALG or routingProtocol LB, DNS, NAT, ALG or routing: 4 CVEs from March to October bulletinsProtocol LB, DNS, NAT, ALG or routing: 10 CVEs in the November 12 bulletin14Management access (NSIP)Management access (NSIP): 1 CVEs from March to October bulletinsManagement access (NSIP): 1 CVEs in the November 12 bulletin2Local access, logs, policies or AppFWLocal access, logs, policies or AppFW: 1 CVEs from March to October bulletinsLocal access, logs, policies or AppFW: 4 CVEs in the November 12 bulletin5March to October bulletinsNovember 12 bulletin

Gateway or AAA virtual servers are the precondition for 9 CVEs and SAML for 5. Protocol features such as DNS, Oracle and SMPP load balancing, LSN ALGs, GSLB and BGP account for 14, 10 of them from today. Two CVEs need nothing at all: CVE-2026-88771 from September, which CISA lists as exploited, and CVE-2026-120868 from today. Today’s bulletin is also the first of 2026 to list authentication actions as a separate attack surface: email OTP, WebAuth, LDAP knowledge-based questions and client certificates, 4 CVEs in all.

2026 against 2023 to 2025

Figure 3. NetScaler ADC and Gateway CVEs by year, stacked by bulletin

NetScaler ADC and Gateway CVEs by year and bulletin01020304050CTX477714, Jul 10, 2023: 2 CVEs, 0 in CISA KEVCTX561482, Jul 18, 2023: 3 CVEs, 1 in CISA KEVCTX579459, Oct 10, 2023: 2 CVEs, 1 in CISA KEV720232 in KEVCTX584986, Jan 16, 2024: 2 CVEs, 2 in CISA KEVCTX677944, Jul 9, 2024: 2 CVEs, 0 in CISA KEVCTX691608, Nov 12, 2024: 2 CVEs, 0 in CISA KEV620242 in KEVCTX693420, Jun 17, 2025: 2 CVEs, 1 in CISA KEVCTX694788, Jun 25, 2025: 1 CVEs, 1 in CISA KEVCTX694938, Aug 26, 2025: 3 CVEs, 1 in CISA KEVCTX695486, Nov 11, 2025: 1 CVEs, 0 in CISA KEV720253 in KEVCTX696300, Mar 23, 2026: 2 CVEs, 1 in CISA KEVCTX696604, Jun 30, 2026: 6 CVEs, 1 in CISA KEVCTX696604 (6)CTX696939, Aug 19, 2026: 2 CVEs, 1 in CISA KEVCTX697096, Sep 27, 2026: 8 CVEs, 2 in CISA KEVCTX697096 (8)CTX697174, Oct 3, 2026: 1 CVEs, 1 in CISA KEVCTX697191, Oct 8, 2026: 1 CVEs, 0 in CISA KEVCTX697305, Nov 12, 2026: 28 CVEs, 0 in CISA KEVCTX697305 (28)482026 to Nov 126 in KEVEach block is one bulletin. Red: CTX697305, published November 12, 2026, with 28 CVEs.
Year Bulletins CVEs CVSS 9.0+ In KEV Median days, bulletin to KEV Federal window, days
2023 3 7 2 2 4.5 21
2024 3 6 0 2 1 21, 7
2025 4 7 3 3 5 1, 2, 21
2026 (to Nov 12) 7 48 15 6 4 3

Even before today, 2026 had 20 CVEs, already above any of the three previous full years. Every 2023 to 2025 bulletin also fell before November 12, so the full-year figures are the same-window figures. CVSS 9.0+ counts use Citrix’s own score: v3.1 for the bulletins up to January 2024 and v4.0 from July 2024 on, so the two eras are not on one scale.

From bulletin to KEV: every NetScaler entry since 2023

Figure 4. Days from Citrix bulletin to KEV listing, and the federal window that followed

NetScaler bulletin to KEV lag and federal window071421304560CVE-2023-3519 (2023)Federal deadline 21 days after KEV listingCVE-2023-3519: bulletin Jul 18, 2023, KEV Jul 19, 2023, 1 days; federal window 21 days; ransomware flag Known1d + 21d RCVE-2023-4966 (2023)Federal deadline 21 days after KEV listingCVE-2023-4966: bulletin Oct 10, 2023, KEV Oct 18, 2023, 8 days; federal window 21 days; ransomware flag Known8d + 21d RCVE-2023-6548 (2024)Federal deadline 7 days after KEV listingCVE-2023-6548: bulletin Jan 16, 2024, KEV Jan 17, 2024, 1 days; federal window 7 days; ransomware flag Unknown1d + 7dCVE-2023-6549 (2024)Federal deadline 21 days after KEV listingCVE-2023-6549: bulletin Jan 16, 2024, KEV Jan 17, 2024, 1 days; federal window 21 days; ransomware flag Unknown1d + 21dCVE-2025-5777 (2025)Federal deadline 1 days after KEV listingCVE-2025-5777: bulletin Jun 17, 2025, KEV Jul 10, 2025, 23 days; federal window 1 days; ransomware flag Known23d + 1d RCVE-2025-6543 (2025)Federal deadline 21 days after KEV listingCVE-2025-6543: bulletin Jun 25, 2025, KEV Jun 30, 2025, 5 days; federal window 21 days; ransomware flag Unknown5d + 21dCVE-2025-7775 (2025)Federal deadline 2 days after KEV listingCVE-2025-7775: bulletin Aug 26, 2025, KEV Aug 26, 2025, 0 days; federal window 2 days; ransomware flag Unknown0d + 2dCVE-2026-3055 (2026)Federal deadline 3 days after KEV listingCVE-2026-3055: bulletin Mar 23, 2026, KEV Mar 30, 2026, 7 days; federal window 3 days; ransomware flag Unknown7d + 3dCVE-2026-8452 (2026)Federal deadline 3 days after KEV listingCVE-2026-8452: bulletin Jun 30, 2026, KEV Aug 26, 2026, 57 days; federal window 3 days; ransomware flag Unknown57d + 3dCVE-2026-19490 (2026)Federal deadline 3 days after KEV listingCVE-2026-19490: bulletin Aug 19, 2026, KEV Sep 9, 2026, 21 days; federal window 3 days; ransomware flag Unknown21d + 3dCVE-2026-88771 (2026)Federal deadline 3 days after KEV listingCVE-2026-88771: bulletin Sep 27, 2026, KEV Sep 27, 2026, 0 days; federal window 3 days; ransomware flag Unknown0d + 3dCVE-2026-88772 (2026)Federal deadline 3 days after KEV listingCVE-2026-88772: bulletin Sep 27, 2026, KEV Sep 27, 2026, 0 days; federal window 3 days; ransomware flag Unknown0d + 3dCVE-2026-88779 (2026)Federal deadline 3 days after KEV listingCVE-2026-88779: bulletin Oct 3, 2026, KEV Oct 4, 2026, 1 days; federal window 3 days; ransomware flag Unknown1d + 3dDot: days from Citrix bulletin to KEV listing. Bar: federal fix window. R: KEV ransomware flag Known.
CVE Issue Citrix bulletin KEV added Days, bulletin to KEV Federal due Window, days KEV ransomware flag
CVE-2026-88779 Memory overflow on SAML SP or IdP, denial of service CTX697174, Oct 3, 2026 Oct 4, 2026 1 Oct 7, 2026 3 Unknown
CVE-2026-88771 Unauthenticated command execution CTX697096, Sep 27, 2026 Sep 27, 2026 0 Sep 30, 2026 3 Unknown
CVE-2026-88772 Memory overflow in DTLS, code execution or DoS CTX697096, Sep 27, 2026 Sep 27, 2026 0 Sep 30, 2026 3 Unknown
CVE-2026-19490 Authentication bypass via alternate path CTX696939, Aug 19, 2026 Sep 9, 2026 21 Sep 12, 2026 3 Unknown
CVE-2026-8452 Memory overflow, denial of service CTX696604, Jun 30, 2026 Aug 26, 2026 57 Aug 29, 2026 3 Unknown
CVE-2026-3055 Memory overread on SAML IdP CTX696300, Mar 23, 2026 Mar 30, 2026 7 Apr 2, 2026 3 Unknown
CVE-2025-7775 Memory overflow, code execution or DoS CTX694938, Aug 26, 2025 Aug 26, 2025 0 Aug 28, 2025 2 Unknown
CVE-2025-5777 Memory overread on Gateway CTX693420, Jun 17, 2025 Jul 10, 2025 23 Jul 11, 2025 1 Known
CVE-2025-6543 Memory overflow, denial of service CTX694788, Jun 25, 2025 Jun 30, 2025 5 Jul 21, 2025 21 Unknown
CVE-2023-6548 Code injection via management interface CTX584986, Jan 16, 2024 Jan 17, 2024 1 Jan 24, 2024 7 Unknown
CVE-2023-6549 Buffer overflow, denial of service CTX584986, Jan 16, 2024 Jan 17, 2024 1 Feb 7, 2024 21 Unknown
CVE-2023-4966 Sensitive information disclosure (Citrix Bleed) CTX579459, Oct 10, 2023 Oct 18, 2023 8 Nov 8, 2023 21 Known
CVE-2023-3519 Unauthenticated remote code execution CTX561482, Jul 18, 2023 Jul 19, 2023 1 Aug 9, 2023 21 Known

The federal window is what changed most. 2023 entries got 21 days. CVE-2025-5777 got 1 day and CVE-2025-7775 got 2. All six 2026 entries got 3, and the 2026 entries from August on cite BOD 26-04 of June 10, 2026, which adds a forensic triage step to the three-day fix. Our analysis of the full KEV catalog shows how these deadlines compare across vendors.

The ransomware flag lags. CISA set it to Known for CVE-2023-3519, CVE-2023-4966, CVE-2025-5777. Its advisory AA23-325A says LockBit 3.0 affiliates exploited CVE-2023-4966, which it calls Citrix Bleed. None of the six 2026 entries carries the flag yet.

The Citrix Bleed lineage: memory overreads on Gateway, AAA and SAML

CVE-2023-4966 leaked memory from appliances configured as a Gateway or AAA virtual server. Citrix’s own bulletin descriptions show the same bug class returning, each time behind a remote-access or identity feature.

CVE Citrix description Precondition Bulletin KEV
CVE-2023-4966 Sensitive information disclosure Gateway or AAA virtual server CTX579459, Oct 10, 2023 Oct 18, 2023, ransomware Known
CVE-2025-5777 Insufficient input validation leading to memory overread Gateway or AAA virtual server CTX693420, Jun 17, 2025 Jul 10, 2025, ransomware Known
CVE-2026-3055 Insufficient input validation leading to memory overread SAML IdP CTX696300, Mar 23, 2026 Mar 30, 2026
CVE-2026-8451 Insufficient input validation leading to memory overread SAML IdP CTX696604, Jun 30, 2026 No
CVE-2026-10817 Insufficient input validation leading to memory overread TCP TimeStamp on LB, CS or VPN CTX696604, Jun 30, 2026 No

Citrix says CVE-2026-3055 was found internally. CISA still listed it 7 days after the bulletin. SAML, as identity provider, service provider or SAML action, has been the precondition for 5 CVEs in 2026 alone. Our VPN vendor scorecard compares NetScaler Gateway with other remote-access products; that cross-vendor comparison is not repeated here.

Citrix NetScaler vulnerability June 2026: CTX696604

The June 30 bulletin covered six CVEs, rated High by Citrix and fixed in 14.1-72.61, 13.1-63.18 and 14.1-72.61 FIPS. CVE-2026-8452, a memory overflow on Gateway or AAA servers, reached KEV on August 26, 57 days later, the longest lag in this set. CVE-2026-13474 is the trap in that bulletin: on HTTP profiles that are not Strict, the new build alone does not fix it, and Citrix says to set http2SmallWndTimeout to 30 seconds by hand. A July 20 revision adds that the same change fixed the HTTP/2 behavior in CERT/CC note VU#885548, reported by Okta’s red team.

Is Citrix NetScaler end of life?

13.1: maintenance has ended

Citrix article CTX241500 gives 13.1 an End of Maintenance date of September 15, 2026 and End of Life on September 15, 2027. Today’s bulletin still ships a 13.1 fix, 13.1-64.39. 14.1 follows a 7 year cycle, with maintenance starting in Q3 2026, End of Maintenance in Q3 2029 and End of Life in Q3 2030.

12.1 and 13.0: unsupported

Citrix’s November 2024 bulletin CTX691608 says 12.1 and 13.0 are End of Life, vulnerable and no longer supported, though 12.1-FIPS builds still appeared in 2025 bulletins. CTX241500 puts 13.0’s End of Life at July 15, 2024. NetScaler Console on-premises 13.1 reached End of Life on April 15, 2026, earlier than the ADC branch.

What this means for MSPs

Patch to the November 12 builds and stop there for the week. Anything below 14.1-73.57 or 13.1-64.39 is below today’s fix, including appliances patched for the October bulletins. The checker above shows which bulletins a given build misses. If a client is still on 13.1, plan the move to 14.1 now: 13.1 left maintenance on September 15.

Check for compromise before you patch any appliance that ran a build below 14.1-73.37 or 13.1-64.23 after September 27. Citrix says exploits of CVE-2026-88771 and CVE-2026-88772 were observed, and CISA’s alert tells organizations to preserve forensic evidence first, because updates may reduce forensic visibility. CISA says Citrix has put indicators of compromise into NetScaler Console, and recommends forwarding NetScaler logs to a SIEM, since local logs may rotate quickly. If you find signs, CISA says to restore a known good backup from before the compromise and rotate local passwords, key-encryption keys and SSL certificates.

Read the preconditions against ns.conf, not the CVSS score. The bulletins give grep patterns for each CVE: add vpn vserver and add authentication vserver for Gateway and AAA, add authentication samlIdPProfile and samlAction for SAML, and -dtls OFF to confirm DTLS is disabled. Two fixes need a setting as well as a build: http2SmallWndTimeout for CVE-2026-13474 and Enhanced ISN Generation for CVE-2026-88778.

Do not stop at the ADC. NetScaler Console needs 14.1-74.34 for today’s CVE-2026-120869, which needs only network access to the Console IP. Secure Private Access hybrid deployments carry the same ADC builds.

Budget for edge-device patching as a recurring cost. 8 minimum fixed 14.1 builds between March 23 and November 12 means a new one every 33 days on average, and two came 6 and 5 days apart. Our zero-day tracker shows why edge appliances get this treatment from attackers.

Frequently asked questions

What is the latest vulnerability reported in Citrix NetScaler?

Bulletin CTX697305, published November 12, 2026, covers 28 ADC and Gateway CVEs, 9 of them rated 9.0 or higher on CVSS v4.0. CVE-2026-120868 (9.3) affects default configurations. The fix is 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS or 13.1-37.293 FIPS and NDcPP. Citrix reports no exploitation, and none was in KEV at our pull. A separate bulletin the same day, CTX697320, fixes CVE-2026-120869 in NetScaler Console.

Which Citrix NetScaler vulnerabilities are exploited in 2026?

CISA KEV lists 6 from 2026 bulletins: CVE-2026-3055 (added March 30), CVE-2026-8452 (August 26), CVE-2026-19490 (September 9), CVE-2026-88771 and CVE-2026-88772 (September 27) and CVE-2026-88779 (October 4). Each had a 3 day federal deadline. CISA also added PHP flaws CVE-2026-109618 and CVE-2026-109619 on October 26, which Citrix says affect NetScaler.

Is Citrix NetScaler end of life?

Not 14.1. Citrix article CTX241500 says 13.1 reached End of Maintenance on September 15, 2026 and reaches End of Life on September 15, 2027, while 14.1 runs to End of Maintenance in Q3 2029 and End of Life in Q3 2030. Versions 12.1 and 13.0 are already End of Life, and Citrix bulletins say they are vulnerable and unsupported.

What are the latest updates for Citrix NetScaler?

The minimum safe builds as of November 12, 2026 are 14.1-73.57, 13.1-64.39, 14.1-73.58 FIPS and 13.1-37.293 for FIPS and NDcPP. On 14.1 that is the 8th minimum fixed build of 2026, up from 14.1-60.58 in March.

What was the Citrix NetScaler vulnerability in June 2026?

Bulletin CTX696604 of June 30, 2026 covers six CVEs, fixed in 14.1-72.61 and 13.1-63.18. One of them, CVE-2026-8452 (memory overflow on Gateway or AAA, CVSS 8.8), was added to KEV on August 26, 57 days later. CVE-2026-13474 also needs a manual http2SmallWndTimeout setting on profiles that are not HTTP Strict.

How many Citrix NetScaler vulnerabilities were there in 2025?

Citrix published 7 ADC and Gateway CVEs in 4 bulletins in 2025, 3 of which CISA added to KEV (CVE-2025-6543, CVE-2025-5777 and CVE-2025-7775). 2026 has 48 so far, more than 2023, 2024 and 2025 combined (20).

Download the data. citrix-netscaler-vulnerabilities-2023-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.

Free to cite and republish with a link to this page.

Methodology

Sources. Citrix security bulletins on support.citrix.com, each page fetched on November 12, 2026 (robots.txt allows /external/article/), and the support site sitemap to find bulletins not yet in NVD. NIST NVD API 2.0, queried by Citrix’s two CNA identifiers, keyword (NetScaler, Citrix ADC, Citrix Gateway) and CPE. CISA KEV catalog version 2026.11.10. CISA’s NetScaler alert (revised October 9, 2026), BOD 26-04 and AA23-325A. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Scope. A CVE counts if a Citrix bulletin for customer-managed NetScaler ADC or NetScaler Gateway names it and the bulletin was published from January 1, 2023 to November 12, 2026: 68 CVEs in 17 bulletins. NetScaler Console, Agent and SDX bulletins, Secure Access client bulletins and third-party component advisories (such as PHP) are excluded from the count and noted where relevant. We cross-checked every NVD record for 2026 against its bulletin reference.

Definitions. Bulletin date is the changelog’s Initial Publication date; exceptions are noted in the lookup table. Days to KEV run from bulletin date to CISA’s dateAdded. Federal window is dueDate minus dateAdded. CVSS is Citrix’s score: v4.0 from the bulletin for 2026, and Citrix’s CNA score in NVD for earlier years. Precondition groups are our grouping of the precondition text in each bulletin.

Limitations. Citrix’s Community blog posts linked from the 2026 bulletins returned HTTP 403 to our fetcher, so we cite only the bulletins and CISA. KEV shows known exploitation, not all exploitation, and today’s CVEs could be added after publication. The checker compares versions only, cannot see configuration, and covers bulletins from 2025 on. We did not test any appliance. We could not find a Citrix bulletin for a CVE number that appears in one search result snippet for this query, so it is not counted.

Not advice. This is an analysis of public records, not a remediation instruction for any environment.

Licensing. NVD and CISA data are US government works. Bulletin facts are cited to Citrix and restated, not republished. The CSV is CC BY 4.0.

Cite as:The Uptime Report. "Citrix NetScaler Vulnerabilities 2026: 48 CVEs in 7 Bulletins, 28 of Them Published Today, and 6 on CISA's Exploited List." November 2026. https://theuptimereport.com/citrix-netscaler-vulnerabilities-2026/

References

  1. Citrix, CTX697305, NetScaler ADC and Gateway Security Bulletin, November 12, 2026. Accessed November 2026.
  2. Citrix, CTX697320, NetScaler Console Security Bulletin for CVE-2026-120869. Accessed November 2026.
  3. CTX697191, CTX697174, CTX697096, CTX696939, CTX696604 and CTX696300, Citrix, 2026 NetScaler ADC and Gateway bulletins. Accessed November 2026.
  4. Citrix, CTX697263, Security Advisory for CVE-2026-109618 and CVE-2026-109619 (PHP). Accessed November 2026.
  5. CTX695486, CTX694938, CTX694788 and CTX693420, Citrix, 2025 bulletins. Accessed November 2026.
  6. CTX691608, CTX677944, CTX584986, CTX579459, CTX561482 and CTX477714, Citrix, 2023 and 2024 bulletins. Accessed November 2026.
  7. Citrix, CTX241500, NetScaler ADC Firmware Release Cycle. Accessed November 2026.
  8. Citrix, Security Bulletin list. Accessed November 2026.
  9. CISA, Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (revised October 9, 2026). Accessed November 2026.
  10. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
  11. CISA, BOD 26-04, Prioritizing Security Updates Based on Risk. Accessed November 2026.
  12. CISA, AA23-325A, LockBit 3.0 Affiliates Exploit CVE-2023-4966 Citrix Bleed. Accessed November 2026.
  13. NIST NVD API 2.0. Accessed November 2026.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts