Citrix vulnerabilities
We track 54 vulnerabilities in Citrix products across 32 products. 51 are rated high or critical, and 27 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Citrix vulnerabilities
- 9.8 Critical severity
Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Exploited
Unauthenticated remote arbitrary code execution
- 8.1 High severity
Citrix Application Delivery Management (Citrix…: Improper Access Control
Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the d
- 7.1 High severity
Citrix Gateway Windows Plugin: Improper Privilege Management
An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt
- 7.8 High severity
Citrix Workspace App for Linux: Improper Access Control
An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.
- 9.8 Critical severity
Citrix ShareFile Improper Access Control Exploited
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
- 4.3 Medium severity
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Exploited
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privil
- 6.5 Medium severity
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Exploited
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low priv
- 6.5 Medium severity
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Exploited
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
- 9.8 Critical severity
Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Exploited
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- 7.5 High severity
Citrix StoreFront Server XML External Entity (XXE) Processing Exploited
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- 8.8 High severity
Citrix SD-WAN and NetScaler Command Injection Exploited
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
- 9.8 Critical severity
Citrix SD-WAN and NetScaler SQL Injection Exploited
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
- 9.8 Critical severity
Citrix Workspace Application and Receiver for Windows Remote Code Execution Exploited
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
- 9.8 Critical severity
Citrix Multiple Products Remote Code Execution Exploited
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.