The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
4 Oct 2026 Citrix NetScaler Memory corruption
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.41, citrix netscaler gateway 14.1-73.41, citrix netscaler application delivery controller 13.1-64.28, citrix netscaler gateway 13.1-64.28, citrix netscaler application delivery controller 13.1-37.282
- CISA due date
- 7 Oct 2026
- Weakness
- CWE-119
27 Sep 2026 Citrix NetScaler Memory corruption
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.37, citrix netscaler gateway 14.1-73.37, citrix netscaler application delivery controller 13.1-64.23, citrix netscaler gateway 13.1-64.23, citrix netscaler application delivery controller 13.1.37.279
- CISA due date
- 30 Sep 2026
- Weakness
- CWE-119
27 Sep 2026 Citrix NetScaler Input validation flaw
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.37, citrix netscaler gateway 14.1-73.37, citrix netscaler application delivery controller 13.1-64.23, citrix netscaler gateway 13.1-64.23, citrix netscaler application delivery controller 13.1.37.279
- CISA due date
- 30 Sep 2026
- Weakness
- CWE-119
9 Sep 2026 Citrix NetScaler Authentication bypass
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-73.32, citrix netscaler gateway 14.1-73.32, citrix netscaler application delivery controller 13.1-63.21, citrix netscaler gateway 13.1-63.21, citrix netscaler application delivery controller 13.1-37.277
- CISA due date
- 12 Sep 2026
- Weakness
- CWE-288
On Hacker News
Detecting and Weaponizing NetScaler26 Aug 2026 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-72.61, citrix netscaler gateway 14.1-72.61, citrix netscaler application delivery controller 13.1-63.18, citrix netscaler gateway 13.1-63.18, citrix netscaler application delivery controller 13.1-37.272
- CISA due date
- 29 Aug 2026
- Weakness
- CWE-119
30 Mar 2026 Citrix NetScaler Memory corruption
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-60.58, citrix netscaler gateway 14.1-60.58, citrix netscaler application delivery controller 13.1-62.23, citrix netscaler gateway 13.1-62.23, citrix netscaler application delivery controller 13.1-37.262
- CISA due date
- 2 Apr 2026
- Weakness
- CWE-125
26 Aug 2025 Citrix NetScaler Memory corruption
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-47.48, citrix netscaler gateway 14.1-47.48, citrix netscaler application delivery controller 13.1-59.22, citrix netscaler gateway 13.1-59.22, citrix netscaler application delivery controller 13.1-37.241 and 1 older
- CISA due date
- 28 Aug 2025
- Weakness
- CWE-119
25 Aug 2025 Citrix Session Recording Remote code execution
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix session recording 2407
- CISA due date
- 15 Sep 2025
- Weakness
- CWE-502
25 Aug 2025 Citrix Session Recording Privilege escalation
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix session recording 2407
- CISA due date
- 15 Sep 2025
- Weakness
- CWE-269
10 Jul 2025 Citrix NetScaler ADC and Gateway Memory corruption
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-43.56, citrix netscaler gateway 14.1-43.56, citrix netscaler application delivery controller 13.1-58.32, citrix netscaler gateway 13.1-58.32, citrix netscaler application delivery controller 13.1-37.235 and 1 older
- CISA due date
- 11 Jul 2025
- Weakness
- CWE-125
30 Jun 2025 Citrix NetScaler ADC and Gateway Memory corruption
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-47.46, citrix netscaler gateway 14.1-47.46, citrix netscaler application delivery controller 13.1-59.19, citrix netscaler gateway 13.1-59.19, citrix netscaler application delivery controller 13.1-37.236
- CISA due date
- 21 Jul 2025
- Weakness
- CWE-119
17 Jan 2024 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-12.35, citrix netscaler gateway 14.1-12.35, citrix netscaler application delivery controller 13.1-51.15, citrix netscaler gateway 13.1-51.15, citrix netscaler application delivery controller 13.1-37.176 and 3 older
- CISA due date
- 7 Feb 2024
- Weakness
- CWE-119
17 Jan 2024 Citrix NetScaler ADC and NetScaler Gateway Remote code execution
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-12.35, citrix netscaler gateway 14.1-12.35, citrix netscaler application delivery controller 13.1-51.15, citrix netscaler gateway 13.1-51.15, citrix netscaler application delivery controller 13.1-37.176 and 3 older
- CISA due date
- 24 Jan 2024
- Weakness
- CWE-94
18 Oct 2023 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- What to do
- Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-8.50, citrix netscaler gateway 14.1-8.50, citrix netscaler application delivery controller 13.1-49.15, citrix netscaler gateway 13.1-49.15, citrix netscaler application delivery controller 13.1-37.164 and 3 older
- CISA due date
- 8 Nov 2023
- Weakness
- CWE-119
16 Aug 2023 Citrix Content Collaboration Access control flaw
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix sharefile storage zones controller 5.11.24
- CISA due date
- 6 Sep 2023
- Weakness
- CWE-284
19 Jul 2023 Citrix NetScaler ADC and NetScaler Gateway Remote code execution
Unauthenticated remote code execution
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 13.1-49.13, citrix netscaler gateway 13.1-49.13, citrix netscaler application delivery controller 13.1-37.159, citrix netscaler application delivery controller 13.0-91.13, citrix netscaler gateway 13.0-91.13 and 1 older
- CISA due date
- 9 Aug 2023
- Weakness
- CWE-94
13 Dec 2022 Citrix Application Delivery Controller (ADC) and Gateway Security flaw
Unauthenticated remote arbitrary code execution
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix application delivery controller firmware 13.0-58.32, citrix gateway firmware 13.0-58.32, citrix application delivery controller firmware 12.1-65.25, citrix gateway firmware 12.1-65.25, citrix application delivery controller firmware 12.1-55.291
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-664
25 Mar 2022 Citrix ShareFile Access control flaw
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix sharefile storagezones controller 5.11.20
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-284
25 Mar 2022 Citrix SD-WAN and NetScaler Command injection
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix sd-wan 10.2.3, citrix netscaler sd-wan 10.0.8
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-78
25 Mar 2022 Citrix SD-WAN and NetScaler SQL injection
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix sd-wan 10.2.3, citrix netscaler sd-wan 10.0.8
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-89
25 Mar 2022 Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server Input validation flaw
Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Authentication bypass
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix application delivery controller firmware 13.0-58.30, citrix gateway firmware 13.0-58.30, citrix application delivery controller firmware 12.1-57.18, citrix netscaler gateway firmware 12.1-57.18, citrix application delivery controller firmware 12.0-63.21 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix application delivery controller firmware 13.0-58.30, citrix gateway firmware 13.0-58.30, citrix application delivery controller firmware 12.1-57.18, citrix netscaler gateway firmware 12.1-57.18, citrix application delivery controller firmware 12.0-63.21 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Authentication bypass
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix application delivery controller firmware 13.0-58.30, citrix gateway firmware 13.0-58.30, citrix application delivery controller firmware 12.1-57.18, citrix netscaler gateway firmware 12.1-57.18, citrix application delivery controller firmware 12.0-63.21 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Citrix StoreFront Server XML external entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix storefront server 1903, citrix storefront server 3.12.4000, citrix storefront server 3.0.8000
- CISA due date
- 3 May 2022
- Weakness
- CWE-611
3 Nov 2021 Citrix Workspace Application and Receiver for Windows Access control flaw
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix workspace 1904
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.