NetScaler® CVE tracker: every exploited ADC and Gateway vulnerability
Every NetScaler ADC and Gateway CVE in the CISA KEV catalog, newest first, with fixed builds, due dates and post-patch steps. Verified against CVE.org.
Latest
Updated
CVE-2026-88779
SAML memory overflow (vendor: DoS; RCE suspected)
- Added to CISA KEV
- 2026-10-04
- Federal due date
- 2026-10-07
- Fixed in (14.1 / 13.1)
- 14.1-73.41 / 13.1-64.28
Exploited NetScaler CVEs, newest first
13 NetScaler ADC and Gateway CVEs from the CISA Known Exploited Vulnerabilities catalog (version 2026.10.15). Fixed builds are the first fixed build per release from the Citrix® security bulletin. FIPS and NDcPP builds have separate fixed builds, listed on each CVE page.
| CVE | Bulletin | CVSS | KEV added / due | Fixed 14.1 / 13.1 | Precondition | Forensic triage | Vendor session kill |
|---|---|---|---|---|---|---|---|
| CVE-2026-88779SAML memory overflow | CTX6971742026-10-03 | 8.7v4.0 | 2026-10-04due 2026-10-07 | 14.1-73.4113.1-64.28 | Configured as SAML SP or SAML IdP | No | No |
| CVE-2026-88771(PitScaler)Unauthenticated command injection | CTX6970962026-09-27 | 9.5v4.0 | 2026-09-27due 2026-09-30 | 14.1-73.3713.1-64.23 | All deployments (default configuration) | Yes | No (community: yes) |
| CVE-2026-88772(PitScaler)DTLS memory overflow leading to RCE | CTX6970962026-09-27 | 9.5v4.0 | 2026-09-27due 2026-09-30 | 14.1-73.3713.1-64.23 | DTLS enabled on a VPN vserver (ON by default) | Yes | No (community: yes) |
| CVE-2026-19490Authentication bypass using an alternate path | CTX6969392026-08-19 | 9.3v4.0 | 2026-09-09due 2026-09-12 | 14.1-73.3213.1-63.21 | Gateway or AAA vserver; on 14.1-43.56+ / 13.1-61.28+ a SAML action (add authentication samlAction) is also required | Yes | No |
| CVE-2026-8452Memory overflow | CTX6966042026-06-30 | 8.8v4.0 | 2026-08-26due 2026-08-29 | 14.1-72.6113.1-63.18 | Configured as Gateway or AAA virtual server | No | No |
| CVE-2026-3055SAML IdP memory overread | CTX6963002026-03-23 | 9.3v4.0 | 2026-03-30due 2026-04-02 | 14.1-66.5913.1-62.23 | Configured as SAML IdP (add authentication samlIdPProfile) | No | No (community: yes) |
| CVE-2025-7775Memory overflow leading to RCE or DoS | CTX6949382025-08-26 | 9.2v4.0 | 2025-08-26due 2025-08-28 | 14.1-47.4813.1-59.22 | Gateway or AAA vserver; OR LB vserver (HTTP/SSL/HTTP_QUIC) bound to IPv6 services; OR CR vserver of type HDX | No | No |
| CVE-2025-5777(CitrixBleed 2)Memory overread | CTX6934202025-06-17 | 9.3v4.0 | 2025-07-10due 2025-07-11 | 14.1-43.5613.1-58.32 | Configured as Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server | No | Yes |
| CVE-2025-6543Memory overflow | CTX6947882025-06-25 | 9.2v4.0 | 2025-06-30due 2025-07-21 | 14.1-47.4613.1-59.19 | Configured as Gateway or AAA virtual server | No | No (community: yes) |
| CVE-2023-6548Authenticated remote code execution on the management interface | CTX5849862024-01-16 | 5.5v3.1 | 2024-01-17due 2024-01-24 | 14.1-12.3513.1-51.15 | Access to NSIP, CLIP or SNIP with management interface access | No | No |
| CVE-2023-6549Denial of service / out-of-bounds read | CTX5849862024-01-16 | 8.2v3.1 | 2024-01-17due 2024-02-07 | 14.1-12.3513.1-51.15 | Configured as Gateway or AAA virtual server | No | No |
| CVE-2023-4966(CitrixBleed)Session token memory leak | CTX5794592023-10-10 | 9.4v3.1 | 2023-10-18due 2023-11-08 | 14.1-8.5013.1-49.15 | Configured as Gateway or AAA virtual server | No | Yes |
| CVE-2023-3519Unauthenticated remote code execution | CTX5614822023-07-18 | 9.8v3.1 | 2023-07-19due 2023-08-09 | Not affected13.1-49.13 | Configured as Gateway or AAA virtual server | No | No |
Scroll the table sideways on small screens. Forensic triage is the CISA KEV flag that asks you to preserve evidence before patching. “Vendor session kill” means the bulletin itself lists session termination after the upgrade.
Current safe builds
The first fixed build is not the end of the story: later bulletins fixed newer CVEs. As of 2026-10-15, every listed fix is included in:
- NetScaler 14.114.1-73.46
- NetScaler 14.1 FIPS14.1-73.46 FIPS
- NetScaler 13.113.1-64.29
- NetScaler 13.1 FIPS/NDcPP13.1-37.283 FIPS
Source: CTX697191 and the earlier bulletins linked in the table.
Older KEV entries (end-of-life releases only)
These predate our bulletin coverage and affect only end-of-life releases. 13.1 and 14.1 are not affected, so they have no page here.
- CVE-2022-27518KEV added 2022-12-13
- CVE-2020-8196KEV added 2021-11-03
- CVE-2020-8195KEV added 2021-11-03
- CVE-2020-8193KEV added 2021-11-03
- CVE-2019-19781KEV added 2021-11-03
2026: 5 KEV events, two emergency upgrades within eight days
CISA added 6 NetScaler CVEs to the KEV catalog in 2026, on 5 separate dates. The KEV additions on 2026-09-27 (PitScaler) and 2026-10-04 (CVE-2026-88779) forced two emergency upgrades within eight days: first to 14.1-73.37 / 13.1-64.23, then to 14.1-73.41 / 13.1-64.28. On 2026-10-08, CTX697191 fixed CVE-2026-107406 in 14.1-73.46 / 13.1-64.29, a fix of the fix that is not in the KEV catalog.
BulletinCTX696300 published: CVE-2026-3055, CVE-2026-4368. Fixed in 14.1-66.59 / 13.1-62.23.
CISA KEVCISA adds CVE-2026-3055 to the Known Exploited Vulnerabilities catalog, federal due date 2026-04-02.
BulletinCTX696604 published: CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474. Fixed in 14.1-72.61 / 13.1-63.18.
BulletinCTX696939 published: CVE-2026-19489, CVE-2026-19490. Fixed in 14.1-73.32 / 13.1-63.21.
CISA KEVCISA adds CVE-2026-8452 to the Known Exploited Vulnerabilities catalog, federal due date 2026-08-29.
CISA KEVCISA adds CVE-2026-19490 to the Known Exploited Vulnerabilities catalog, federal due date 2026-09-12.
BulletinCTX697096 published (PitScaler): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778. Fixed in 14.1-73.37 / 13.1-64.23.
CISA KEVCISA adds CVE-2026-88771, CVE-2026-88772 to the Known Exploited Vulnerabilities catalog, federal due date 2026-09-30.
BulletinCTX697174 published: CVE-2026-88779. Fixed in 14.1-73.41 / 13.1-64.28. Supersedes CTX697096.
CISA KEVCISA adds CVE-2026-88779 to the Known Exploited Vulnerabilities catalog, federal due date 2026-10-07.
BulletinCTX697191 published: CVE-2026-107406. Fixed in 14.1-73.46 / 13.1-64.29. Supersedes CTX697174 and CTX697096. Not in the CISA KEV catalog as of version 2026.10.15.
Sources: KEV dates from the CISA KEV JSON feed (catalog 2026.10.15); bulletin dates and fixed builds from the linked vendor bulletins.
How we verify
Every fact on these pages comes from three primary sources:
- The CISA KEV catalog JSON feed, catalog version 2026.10.15: KEV dates, federal due dates, the vulnerability name and known ransomware use.
- CVE.org records, linked from every CVE page.
- The vendor security bulletins (CTX articles): fixed builds per release, CVSS scores, preconditions and post-patch steps.
A CVE gets a page only when it is in the KEV catalog and the KEV dates in our advisory data match the feed exactly. We do not publish a date, score or build that is not in those sources. Community guidance (CISA advisories, national CERTs, researchers) is labelled as such.
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1. Coverage: NetScaler ADC and NetScaler Gateway security bulletins from May 2023 (CTX477714) to 8 Oct 2026 (CTX697191). Older KEV entries affect only end-of-life releases (see legacyKev). NetScaler Console/SDX SVM bulletins are out of scope.
Is your build affected?
Paste a build or the output of show ns version to see which of these CVEs apply and which build to move to.
Patching against a KEV deadline?
Nightpatch runs approval-gated, HA-aware NetScaler upgrades: secondary first, failover, primary, post-checks and a planned rollback path, with every step logged.