Skip to content
COOEY

FAIL › dossier

NetScaler

PRODUCT

· dossier confidence 20%

Citrix NetScaler is a widely deployed ADC with a history of critical memory corruption vulnerabilities that result in remote code execution and sensitive data exposure. CISA has issued binding patch orders for recent flaws, and the product continues to be actively exploited in the wild.

Failure events
6
Zero-days
0
RCEs
4
On KEV
6
Critical
0
Worst shame
88
PROFILE
Categorynetwork security / ADCWhat they doCitrix NetScaler is an application delivery controller (ADC) and network security appliance that provides load balancing, SSL offloading, and web application firewall (WAF) capabilities. Websitehttps://www.citrix.com/products/netScaler.html ↗
SECURITY POSTURE

NetScaler has a poor security track record, with multiple high-severity remote code execution (RCE) and memory corruption vulnerabilities exploited in the wild, including CVE-2025-7775, CVE-2026-3055, and CVE-2026-8452, which CISA ordered patched under BOD 26-04.

Notable failures
  • CVE-2025-7775 RCE via memory overflow
  • CVE-2026-3055 SAML IDP out-of-bounds memory read
  • CVE-2026-8452 RCE exploited in the wild, CISA BOD 26-04 patch order
Patterns: repeated unpatched edge-device RCEs; memory corruption leading to RCE or sensitive data exfiltration; downplayed severity before exploitation
FAILURE HISTORY · 6
DATEEVENTSEVSUMMARY
2026-09-09 CVE-2026-19490 high An unauthenticated remote attacker can bypass Citrix NetScaler authentication via an alternate path, enabling full system compromise.
2026-09-27 CVE-2026-88771 high An unauthenticated attacker can execute arbitrary commands on Citrix NetScaler ADC and Gateway due to improper input validation.
2026-09-27 CVE-2026-88772 high Citrix NetScaler ADC and Gateway suffer a memory buffer flaw enabling remote code execution or denial of service.
2025-08-26 CVE-2025-7775 high Citrix NetScaler exposed to remote code execution due to memory overflow
2026-10-04 CVE-2026-88779 high Citrix NetScaler ADC and Gateway suffer a memory buffer vulnerability causing denial of service, part of a pattern of critical flaws exploited in the wild.
2026-03-30 CVE-2026-3055 high Citrix NetScaler SAML IDP configuration allows out-of-bounds memory reads, enabling attackers to read sensitive data without code execution.
DOSSIER SOURCES
Open questions: How does Citrix prioritize patching for NetScaler vulnerabilities? · What is the current patching SLA for NetScaler?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-04 03:48:10.131767+00:00