Skip to content
COOEY

FAIL › dossier

netscaler gateway

PRODUCT

· dossier confidence 20%

Citrix NetScaler Gateway is a critical network security product with a history of severe, recurring vulnerabilities including remote code execution and authentication bypasses. The product frequently requires urgent patches and has been observed in active exploitation campaigns, posing significant risk to organizations relying on it for secure remote access.

Failure events
10
Zero-days
0
RCEs
3
On KEV
0
Critical
10
Worst shame
85
PROFILE
CategoryCybersecurity / Network SecurityWhat they doCitrix NetScaler Gateway is a secure access service edge (SASE) and application delivery controller (ADC) solution that provides secure remote access, load balancing, and traffic management for enterprise networks. Websitehttps://www.citrix.com/products/netScaler.html ↗
SECURITY POSTURE

The product has a poor security track record characterized by repeated critical vulnerabilities in memory handling and authentication bypasses, often requiring urgent patches and facing active exploitation in the wild.

Notable failures
  • CVE-2026-19490: Critical authentication bypass (CVSS 9.3) actively exploited
  • CVE-2026-19490: Critical RCE in ADC/Gateway 14.1-73.32 and 13.1-63.21
  • CVE-2026-8655: Critical memory overflow leading to DoS
  • CVE-2026-8452: Critical memory overflow leading to DoS
  • CVE-2023-3519: Critical unauthenticated RCE
  • CVE-2019-19781: Critical RCE in ADC/Gateway
Patterns: repeated critical memory overflow vulnerabilities; unpatched edge-device RCEs; authentication bypass flaws in gateway configurations
FAILURE HISTORY · 10
DATEEVENTSEVSUMMARY
2026-09-27 CVE-2026-88771 critical CVE-2026-88771 allows unauthenticated remote code execution in Citrix NetScaler ADC and Gateway via improper input validation.
2026-09-27 CVE-2026-88773 critical Citrix NetScaler ADC and Gateway suffer from HTTP request/response smuggling allowing attackers to bypass security controls and execute arbitrary code.
2026-08-19 CVE-2026-19490 critical Citrix NetScaler ADC and Gateway versions 14.1-73.32 and 13.1-63.21 contain a critical vulnerability (CVE-2026-19490) that could allow remote code execution.
2026-09-27 CVE-2026-88775 critical A critical memory overflow flaw in Citrix NetScaler ADC and Gateway allows remote denial of service or unpredictable behavior before version 14.1-73.37.
2026-09-27 CVE-2026-88777 critical A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
2026-09-27 CVE-2026-88776 critical A memory overflow vulnerability in Citrix NetScaler ADC and Gateway allows denial of service or unpredictable behavior before version 14.1-73.37.
2026-06-30 CVE-2026-8452 critical Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
2026-06-30 CVE-2026-8655 critical Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured
2023-07-19 CVE-2023-3519 critical CVE-2023-3519: Unauthenticated remote code execution
2019-12-27 CVE-2019-19781 critical CVE-2019-19781: An issue was discovered in Citrix Application Delivery Controller (ADC) and Gate
DOSSIER SOURCES
Open questions: Current patching SLA for NetScaler Gateway · Number of active zero-day exploits targeting NetScaler Gateway
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-13 04:38:29.457588+00:00