Critical Citrix NetScaler Flaws Expose ADC and Gateway Appliances
Citrix NetScaler ADC and NetScaler Gateway appliances are affected by multiple critical vulnerabilities that can expose organizations to compromise, including CVE-2025-5349, CVE-2025-5777, and CVE-2026-3055. The flaws impact supported NetScaler releases, while end-of-life versions 12.1 and 13.0 remain vulnerable without fixes. CVE-2025-5349 enables access-control bypass on the management interface, CVE-2025-5777 is an out-of-bounds read that can leak sensitive memory contents, and CVE-2026-3055 is an input-validation flaw that can lead to memory overwrite when NetScaler is configured as a SAML Identity Provider.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Citrix discloses CVE-2026-3055 in NetScaler ADC and Gateway
A March 2026 advisory disclosed CVE-2026-3055, a critical insufficient input validation flaw in supported NetScaler ADC and NetScaler Gateway versions that can enable memory overwrite. Exploitation is possible when NetScaler is configured as a SAML Identity Provider, and customers were advised to upgrade to fixed releases.
Citrix discloses new NetScaler flaws including CVE-2025-7775 and CVE-2025-8424
On 2025-08-26, a new advisory described multiple vulnerabilities affecting supported NetScaler ADC and NetScaler Gateway versions, including CVE-2025-7775, CVE-2025-5777, and CVE-2025-8424. Citrix urged immediate upgrades and noted that Secure Private Access on-prem and Hybrid instances using NetScaler are also affected, while end-of-life 12.1 and 13.0 versions remain vulnerable.
Proof-of-concept exploit for NetScaler flaws is published and used in attacks
By 7 August 2025, continued global exploitation of the NetScaler vulnerabilities was being observed, and a proof-of-concept exploit had been published and was actively used. Guidance recommended patching immediately, terminating active ICA and PCoIP sessions after updates, and reviewing logs for indicators of compromise.
Citrix discloses critical NetScaler flaws CVE-2025-5349 and CVE-2025-5777
A June 2025 advisory reported two critical vulnerabilities affecting supported NetScaler ADC and NetScaler Gateway versions: CVE-2025-5349, which can bypass access controls on the management interface, and CVE-2025-5777, an out-of-bounds read issue that can expose sensitive memory contents. Customers were urged to update to fixed versions, with end-of-life 12.1 and 13.0 versions noted as still vulnerable.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
8 references tracked. Mallory keeps watching after this page renders.
Kriittinen haavoittuvuus Citrix NetScaler ADC ja NetScaler Gateway -tuotteissa | Kyberturvallisuuskeskus
kyberturvallisuuskeskus.fi
Open sourceKriittinen haavoittuvuus Citrix NetScaler ADC ja NetScaler Gateway -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceKriittinen haavoittuvuus Citrix NetScaler ADC ja NetScaler Gateway -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceCitrix NetScaler ADC ja NetScaler Gateway -tuotteissa kriittinen haavoittuvuus | Traficom
kyberturvallisuuskeskus.fi
Open sourceCitrix NetScaler ADC ja NetScaler Gateway -tuotteissa kriittinen haavoittuvuus | Traficom
kyberturvallisuuskeskus.fi
Open sourceKriittinen ja hyväksikäytetty haavoittuvuus NetScaler ADC ja NetScaler Gateway -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceKriittinen haavoittuvuus NetScaler ADC ja NetScaler Gateway -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceKriittinen haavoittuvuus NetScaler ADC ja NetScaler Gateway -tuotteissa | Traficom
kyberturvallisuuskeskus.fi
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026
Citrix NetScaler Flaws Enable RCE and Session Token Theft
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
Critical Vulnerabilities Disclosed in Citrix NetScaler ADC and Gateway
Citrix disclosed critical vulnerabilities affecting **NetScaler ADC** and **NetScaler Gateway**, prompting alerts from both the Canadian Centre for Cyber Security and CERT-EU. The issues are tracked as `CVE-2026-3055` and `CVE-2026-4368`, and impact multiple supported release branches, including **14.1**, **13.1**, and **13.1 FIPS/NDcPP** versions running below the vendor’s fixed builds. Affected deployments include standard **NetScaler ADC**, **NetScaler Gateway**, and hardened **FIPS/NDcPP** editions. Government cyber authorities urged organizations to review Citrix’s security bulletin and apply the recommended updates and mitigations without delay. The coordinated advisories indicate broad concern across enterprise and public-sector environments that rely on Citrix application delivery and remote access infrastructure, with administrators advised to identify exposed appliances and move vulnerable systems to patched versions listed by Citrix.
Jul 1, 2026