Citrix vulnerabilities and fixes

CVEs that mention Citrix, ranked by priority. 6 tracked.

Citrix has 6 tracked vulnerabilities, 3 critical and 5 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 5. Most recent: 2026-10-04. Highest priority: CVE-2026-88771 (score 98/100).

• CVE-2026-88771 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-19490 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
• CVE-2026-88772 HIGH 8.1 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-8452 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-88779 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
• CVE-2026-18751 MEDIUM 5.2 External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects Work

FAQ

How do I fix Citrix vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Citrix being exploited right now?

Yes: 5 Citrix CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Citrix CVE should I patch first?

CVE-2026-88771 currently ranks highest (98/100): Citrix NetScaler Improper Input Validation Vulnerability.

← Back to latest CVEs