# NetScaler vulnerabilities & exploitation **CISA KEV** > As of 2026-10-05, Threadlinqs tracks 9 NetScaler CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 4 tracked threat campaigns. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 9 NetScaler CVEs published between 2025-11-15 and 2026-08-15. The busiest month was 2026-06 (6 new CVEs). 1 of them (11%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 9 of 9 tracked NetScaler CVEs. - [CVE-2026-19490](https://intel.threadlinqs.com/cve/CVE-2026-19490) — CRITICAL 9.8 · KEV · EPSS 7% · 2026-08-19 - [CVE-2025-12101](https://intel.threadlinqs.com/cve/CVE-2025-12101) — MEDIUM 5.9 · EPSS 25.1% · 2025-11-11 - [CVE-2026-8451](https://intel.threadlinqs.com/cve/CVE-2026-8451) — HIGH 7.5 · EPSS 0.5% · 2026-06-30 - [CVE-2026-8452](https://intel.threadlinqs.com/cve/CVE-2026-8452) — CRITICAL 9.8 · EPSS 0.5% · 2026-06-30 - [CVE-2026-8655](https://intel.threadlinqs.com/cve/CVE-2026-8655) — CRITICAL 9.8 · EPSS 0.5% · 2026-06-30 - [CVE-2026-10817](https://intel.threadlinqs.com/cve/CVE-2026-10817) — HIGH 7.5 · EPSS 0.4% · 2026-06-30 - [CVE-2026-13474](https://intel.threadlinqs.com/cve/CVE-2026-13474) — HIGH 7.5 · EPSS 0.4% · 2026-06-30 - [CVE-2026-10816](https://intel.threadlinqs.com/cve/CVE-2026-10816) — HIGH 7.5 · EPSS 0.2% · 2026-06-30 - [CVE-2026-19489](https://intel.threadlinqs.com/cve/CVE-2026-19489) — HIGH 8.8 · 2026-08-19 ## Products affected Threadlinqs normalises CPE and CNA product records across all 9 CVEs; 2 distinct NetScaler products are affected. The most frequently affected: - ADC — 9 CVEs - Gateway — 9 CVEs ## Threat activity 4 tracked threat campaigns reference NetScaler products or exploit NetScaler CVEs: - [CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with Accompanying CVE-2026-19489 Memory Overflow (CVSS 8.8)](https://intel.threadlinqs.com/threat/TL-2026-2080) — CRITICAL — 2026-08-20 - [CitrixBleed-Class NetScaler ADC/Gateway SAML AuthnRequest Memory Disclosure (CVE-2026-8451) Exploited Within 24 Hours of Disclosure](https://intel.threadlinqs.com/threat/TL-2026-1078) — CRITICAL — 2026-07-02 - [CVE-2026-8451: Memory Overread in Citrix NetScaler ADC/Gateway SAML IdP ('CitrixBleed'-class, CVSS 8.8) — Exploited Within 24 Hours of Disclosure](https://intel.threadlinqs.com/threat/TL-2026-1092) — HIGH — 2026-07-02 - [CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-1140) — CRITICAL — 2026-06-30 ## How to prioritise NetScaler patching This order follows the data Threadlinqs holds for NetScaler, not a generic severity checklist: - 1 of 9 NetScaler CVEs (11%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-19490](https://intel.threadlinqs.com/cve/CVE-2026-19490). - Outside KEV, the highest EPSS scores are [CVE-2025-12101](https://intel.threadlinqs.com/cve/CVE-2025-12101) (25.1%), [CVE-2026-8451](https://intel.threadlinqs.com/cve/CVE-2026-8451) (0.5%), [CVE-2026-8452](https://intel.threadlinqs.com/cve/CVE-2026-8452) (0.5%). - 3 CVEs score Critical and 5 High on CVSS v3 (maximum 9.8, average 8.2); sequence these after KEV and high-EPSS items. - 3 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/netscaler All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp