The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
10 Jul 2025 Citrix NetScaler ADC and Gateway Memory corruption
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-43.56, citrix netscaler gateway 14.1-43.56, citrix netscaler application delivery controller 13.1-58.32, citrix netscaler gateway 13.1-58.32, citrix netscaler application delivery controller 13.1-37.235 and 1 older
- CISA due date
- 11 Jul 2025
- Weakness
- CWE-125
18 Oct 2023 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- What to do
- Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-8.50, citrix netscaler gateway 14.1-8.50, citrix netscaler application delivery controller 13.1-49.15, citrix netscaler gateway 13.1-49.15, citrix netscaler application delivery controller 13.1-37.164 and 3 older
- CISA due date
- 8 Nov 2023
- Weakness
- CWE-119
19 Jul 2023 Citrix NetScaler ADC and NetScaler Gateway Remote code execution
Unauthenticated remote code execution
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 13.1-49.13, citrix netscaler gateway 13.1-49.13, citrix netscaler application delivery controller 13.1-37.159, citrix netscaler application delivery controller 13.0-91.13, citrix netscaler gateway 13.0-91.13 and 1 older
- CISA due date
- 9 Aug 2023
- Weakness
- CWE-94
25 Mar 2022 Citrix ShareFile Access control flaw
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix sharefile storagezones controller 5.11.20
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-284
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Citrix StoreFront Server XML external entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix storefront server 1903, citrix storefront server 3.12.4000, citrix storefront server 3.0.8000
- CISA due date
- 3 May 2022
- Weakness
- CWE-611
3 Nov 2021 Citrix Workspace Application and Receiver for Windows Access control flaw
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix workspace 1904
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.