Vendor scorecard

Citrix

Citrix security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.

CPE: citrix

Product families

Open in latest

Inferred — see methodology

Last disclosure

Oct 4, 2026

Product categories

1 tracked

CVE volume, severity mix and the inferred latest shipping version per category.

Category	CVEs	Volume	Severity mix	Open	Inferred latest
NetScaler ADC/GatewayApplication Delivery / ADC · Secure Remote Access / VPN · Zero-Trust / ZTNAnetscaler_application_delivery_controller, netscaler_gateway, netscaler_adc	24			16	14.1-73.41HIGH

Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Citrix total above.

Disclosure trend

12 months

Cumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.

Critical
High
Medium
Low

Recent CVEs

12 shown

Most recently published, newest first. Each ID links to its NVD record.

Recent CVEs affecting Citrix
CVE	Severity	CVSS	Summary	Published
CVE-2026-88779(opens NVD record)	High	7.5	Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.	Oct 4, 2026
CVE-2026-88778(opens NVD record)	High	7.5	Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.	Sep 27, 2026
CVE-2026-88777(opens NVD record)	Critical	9.8	Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service	Sep 27, 2026
CVE-2026-88776(opens NVD record)	Critical	9.8	Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service	Sep 27, 2026
CVE-2026-88775(opens NVD record)	Critical	9.8	Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service	Sep 27, 2026
CVE-2026-88774(opens NVD record)	High	7.2	Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.	Sep 27, 2026
CVE-2026-88773(opens NVD record)	Critical	10.0	Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.	Sep 27, 2026
CVE-2026-88772(opens NVD record)	High	8.1	Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service	Sep 27, 2026
CVE-2026-88771(opens NVD record)	Critical	9.8	Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.	Sep 27, 2026
CVE-2026-19490(opens NVD record)	Critical	9.8	Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.	Aug 19, 2026
CVE-2026-8655(opens NVD record)	Critical	9.8	Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment	Jun 30, 2026
CVE-2026-8452(opens NVD record)	Critical	9.8	Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server	Jun 30, 2026

24 CVEs · 1 product families