Short answer: this page lists every Citrix vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in 2026, meaning there is evidence of exploitation in the wild, with the fix and a link to our Daily Brief coverage where we wrote about it. If you run any product in the table, treat its row as a patch-now item.
How to use this page
Match products first. Compare the Product column with your asset inventory. Only rows for products and versions you run matter to you.
Patch newest and internet-facing first. Rows are sorted by the date CISA added them. Recently added flaws on exposed systems are usually the most urgent.
Use the Fix column. It shows CISA’s required action and links to Citrix’s advisory (or the NVD entry when CISA lists no advisory) for fixed versions and workarounds.
Check for compromise, not just patch status. Where we covered a flaw, the Our coverage link has exposure checks and what to hunt for. Patching does not remove an attacker who is already in.
U.S. federal agencies must remediate KEV entries by the due date CISA sets; everyone else can use KEV as a priority list.
Citrix vulnerabilities exploited in 2026
As of 2026-10-16 (CISA KEV catalog version 2026.10.16), CISA lists 6 Citrix vulnerabilities added to the Known Exploited Vulnerabilities catalog in 2026. CyberExperts has covered 5 of them in the Daily Brief. Newest additions are first.
NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
The table is compiled from CISA’s Known Exploited Vulnerabilities catalog and our own Daily Brief coverage, and we refresh it as CISA adds entries. A missing row means CISA has not added that flaw to KEV this year, not that it is safe to ignore. Always confirm fixed versions in the vendor advisory.
