Skip to content
COOEY

FAIL › dossier

netscaler application delivery controller

PRODUCT

· dossier confidence 20%

Citrix NetScaler ADC is a widely deployed application delivery controller with a severe security track record. The product has suffered multiple critical vulnerabilities, including remote code execution and memory overflows, that have been actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog.

Failure events
9
Zero-days
0
RCEs
3
On KEV
0
Critical
9
Worst shame
85
PROFILE
CategoryApplication Delivery ControllerWhat they doCitrix NetScaler ADC is an application delivery controller that provides load balancing, SSL offloading, and application security for enterprise networks. Websitehttps://www.citrix.com/products/netScaler.html ↗
SECURITY POSTURE

The product has a critical security track record with multiple unpatched critical vulnerabilities, including remote code execution and memory overflow issues, that have been actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog.

Notable failures
  • CVE-2026-19490: Critical unauthenticated RCE via SAML deserialization
  • CVE-2026-8655: Critical memory overflow leading to DoS
  • CVE-2026-8452: Critical memory overflow leading to DoS
  • CVE-2023-3519: Critical unauthenticated RCE
Patterns: repeated critical RCE and memory overflow vulnerabilities; delayed patching of critical flaws leading to active exploitation; vulnerabilities added to CISA KEV catalog
FAILURE HISTORY · 9
DATEEVENTSEVSUMMARY
2026-09-27 CVE-2026-88771 critical CVE-2026-88771 allows unauthenticated remote code execution in Citrix NetScaler ADC and Gateway via improper input validation.
2026-09-27 CVE-2026-88773 critical Citrix NetScaler ADC and Gateway suffer from HTTP request/response smuggling allowing attackers to bypass security controls and execute arbitrary code.
2026-08-19 CVE-2026-19490 critical Citrix NetScaler ADC and Gateway versions 14.1-73.32 and 13.1-63.21 contain a critical vulnerability (CVE-2026-19490) that could allow remote code execution.
2026-09-27 CVE-2026-88775 critical A critical memory overflow flaw in Citrix NetScaler ADC and Gateway allows remote denial of service or unpredictable behavior before version 14.1-73.37.
2026-09-27 CVE-2026-88777 critical A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
2026-09-27 CVE-2026-88776 critical A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
2026-06-30 CVE-2026-8452 critical Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
2026-06-30 CVE-2026-8655 critical Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured
2023-07-19 CVE-2023-3519 critical CVE-2023-3519: Unauthenticated remote code execution
DOSSIER SOURCES
Open questions: Current patch status for CVE-2026-19490 and CVE-2026-8655 · Citrix's vulnerability disclosure timeline for 2026-2027
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-13 04:40:50.886684+00:00