Citrix vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 10 Citrix CVEs published between 2019-12-15 and 2026-03-15. The busiest month was 2023-07 (3 new CVEs). 6 of them (60%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 10 of 10 tracked Citrix CVEs.

• CVE-2019-19781critical 9.8KEVRansomwareEPSS 94.4%2019-12-27
• CVE-2023-4966critical 9.4KEVRansomwareEPSS 94.3%2023-10-10
• CVE-2023-3519critical 9.8KEVRansomwareEPSS 93.8%2023-07-19
• CVE-2026-3055critical 9.3KEVEPSS 89.7%2026-03-23
• CVE-2025-5777high 7.5KEVRansomwareEPSS 62.3%2025-06-17
• CVE-2025-7775critical 9.8KEVEPSS 5.7%2025-08-26
• CVE-2025-5775critical 9.1EPSS 72.4%
• CVE-2023-3466high 8.3EPSS 1.1%2023-07-19
• CVE-2023-3467high 8EPSS 0.4%2023-07-19
• CVE-2026-4368high 7.7EPSS 0%2026-03-23

Products affected

Threadlinqs normalises CPE and CNA product records across all 10 CVEs; 8 distinct Citrix products are affected. The most frequently affected:

• Netscaler Gateway 10 CVEs
• Netscaler Application Delivery Controller 7 CVEs
• NetScaler ADC 2 CVEs
• Application Delivery Controller 1 CVE
• Application Delivery Controller Firmware 1 CVE
• Gateway 1 CVE
• Gateway Firmware 1 CVE
• Netscaler Gateway Firmware 1 CVE

Threat activity

29 tracked threat campaigns reference Citrix products or exploit Citrix CVEs; the 25 most recent are listed.

• Desktop AI Supercomputers, Uncensored Models and Agentic Frameworks (HexStrike-AI) Enable Automated Large-Scale Attacks, incl. CVE-2025-7775 Citrix NetScalerHIGH2026-10-03
• Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)CRITICAL2026-09-27
• CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV CatalogCRITICAL2026-09-27
• 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)HIGH2026-08-23
• LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)HIGH2026-08-21
• AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078)HIGH2026-08-09
• GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 OrganizationsHIGH2026-08-06
• Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436)HIGH2026-07-31
• AI-Generated Extortion: Fabricated Data-Leak Sites 0APT and ALP-001 Impersonate Ransomware GroupsMEDIUM2026-07-29
• Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2 (CVE-2025-5777) Exploitation WaveCRITICAL2026-07-27
• Sen. Wyden Urges Binding Federal Mandate to Purge Internet-Facing Legacy VPNs for Zero-Trust Remote AccessMEDIUM2026-07-27
• Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion DemandsMEDIUM2026-07-22
• CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC HandlingHIGH2026-07-19
• CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access Broker for DragonForce Ransomware DeploymentCRITICAL2026-07-09
• CitrixBleed-Class NetScaler ADC/Gateway SAML AuthnRequest Memory Disclosure (CVE-2026-8451) Exploited Within 24 Hours of DisclosureCRITICAL2026-07-02
• Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege EscalationCRITICAL2026-07-02
• FortiBleed Credential-Harvesting Campaign Against 430,000 FortiGate Firewalls Feeds INC Ransom and Lynx Ransomware OperationsCRITICAL2026-07-02
• CVE-2026-8451: Memory Overread in Citrix NetScaler ADC/Gateway SAML IdP ('CitrixBleed'-class, CVSS 8.8) — Exploited Within 24 Hours of DisclosureHIGH2026-07-02
• Black Basta Ransomware Operation - Organizational Breakdown & 2025 ShutdownCRITICAL2026-06-30
• CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active ExploitationCRITICAL2026-06-30
• Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXiCRITICAL2026-04-22
• The Gentlemen Ransomware Operationalizes SystemBC SOCKS5 Botnet of 1,570+ Corporate Hosts for Double-Extortion OperationsHIGH2026-04-20
• CitrixBleed 3 — CVE-2026-3055 & CVE-2026-4368 NetScaler ADC/Gateway Memory Overread and Session HijackCRITICAL2026-04-17
• Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365HIGH2026-04-06
• CVE-2026-3055 & CVE-2026-4368: Citrix NetScaler ADC/Gateway Pre-Auth Memory Overread and Session MixupCRITICAL2026-03-28

Threat actors targeting Citrix

Named threat actors attributed to campaigns that involve Citrix products or CVEs, with the number of linked campaigns:

• INC Ransom 2
• The Gentlemen 2
• Akira 1
• Anubis 1
• APT29 1
• Black Basta 1
• Clop 1
• DragonForce 1
• EvilTokens PhaaS Operators 1
• INC Ransom - G1032 1
• LockBit 1
• Midnight Blizzard 1

How to prioritise Citrix patching

This order follows the data Threadlinqs holds for Citrix, not a generic severity checklist:

• 6 of 10 Citrix CVEs (60%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2019-19781, CVE-2023-4966, CVE-2023-3519.
• 4 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2025-5775 (72.4%), CVE-2023-3466 (1.1%), CVE-2023-3467 (0.4%).
• 6 CVEs score Critical and 4 High on CVSS v3 (maximum 9.8, average 8.9); sequence these after KEV and high-EPSS items.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.