Vendor scorecard

Citrix exploited vulnerabilities: 27 in CISA KEV, 6 in the last 12 months

Gociux · updated with each KEV addition · latest 4 Oct 2026

CISA lists 27 Citrix vulnerabilities as exploited in the wild, 6 of them added in the last 12 months (up from 5 in the 12 months before). 7 (26%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 7 days. Most affected: NetScaler (6), NetScaler ADC and NetScaler Gateway (5), Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance (4).

Exploited CVEs added per year

Most affected products

Every exploited Citrix CVE

Get an email when CISA adds the next Citrix CVE.

How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (11 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.