How many CVEs does Citrix have?

Citrix has 460 published CVE records since 2000, including 22 in the last two years.

How many Citrix CVEs are in CISA KEV?

Yes — 24 of Citrix's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Citrix products have the most CVEs?

The Citrix products with the most published CVEs are hypervisor, XenServer, NetScaler Gateway, netscaler_application_delivery_controller, netscaler gateway firmware.

What are the most common weakness types in Citrix CVEs?

Citrix's CVEs most often map to these CWE weakness types: CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference).

Are there public exploits for Citrix vulnerabilities?

Yes — 70 of Citrix's CVEs have a known public exploit.

How many critical Citrix vulnerabilities are there?

Citrix has 83 critical and 189 high-severity CVEs.

What is the average severity of Citrix CVEs?

The average CVSS base score across Citrix's scored CVEs is 7.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

460 CVEs

24 in CISA KEV

Citrix Vulnerabilities

Name: Citrix vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Citrix.

460

Total CVEs

Published

24

In CISA KEV

Exploited in the wild

70

Public exploits

PoC or exploit code

7.1

Avg CVSS

2000–2026

Overview

Citrix has 460 published CVE records since 2000, of which 24 are in CISA's Known Exploited Vulnerabilities catalog and 70 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Citrix products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Citrix's vulnerability posture, as a share of its 460 published CVEs.

Average CVSS: 7.1
Critical / high: 59%
Actively exploited (KEV): 5%
Public exploit available: 15%
Patch available: 52%

Severity and exploitation

How the CVSS severity of Citrix's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical83

High189

Medium173

Low15

In CISA’s Known Exploited Vulnerabilities catalog

24

24 of Citrix's CVEs are confirmed exploited in the wild.

Public exploits

70

70 of Citrix's CVEs have a known public exploit available.

Most affected products

The Citrix products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Citrix CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Citrix CVE records.

Disclosure activity by year

How many Citrix CVEs were published each year.

2019

23

2020

44

2021

33

2022

40

2023

31

2024

30

2025

13

2026

9

Latest Citrix CVEs

The most recently disclosed vulnerabilities affecting Citrix.

Out-of-bounds memory read
CWE-125
Medium · CVSS 6.8
EPSS 0.1%2026-07-14
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges
CWE-269
High · CVSS 8.5
EPSS 0.1%2026-07-14
Denial of service via malformed HTTP/2 requests
CWE-401
High · CVSS 8.7
EPSS 0.4%2026-06-30
Insufficient input validation leading to memory overread
CWE-125
Medium · CVSS 6.9
EPSS 0.4%2026-06-30
Arbitrary File Read (Unauthenticated)
CWE-73
High · CVSS 7.1
EPSS 0.4%2026-06-30
Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service
CWE-119
High · CVSS 8.8
EPSS 0.5%2026-06-30
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
CWE-119
High · CVSS 8.8
EPSS 0.5%2026-06-30
Insufficient input validation leading to memory overread
CWE-125
High · CVSS 8.8
EPSS 0.5%2026-06-30
Insufficient input validation leading to memory overread
CISA KEV
CWE-125
Critical · CVSS 9.3
EPSS 84.0%2026-03-23
Improper access control on the NetScaler Management Interface
CWE-1284
High · CVSS 8.7
EPSS 2.7%2025-08-26
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
CWE-119
High · CVSS 8.8
EPSS 6.7%2025-08-26
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
CISA KEV
CWE-119
Critical · CVSS 9.2
EPSS 19.0%2025-08-26

Track new Citrix CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Citrix CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

fabian483 CVEs HCLTech474 CVEs Atlassian471 CVEs HackerOne470 CVEs mediawiki466 CVEs Magento438 CVEs QEMU434 CVEs tensorflow434 CVEs

Browse all vendors

Frequently asked questions

Common questions about Citrix vulnerabilities.

How many CVEs does Citrix have?: Citrix has 460 published CVE records since 2000, including 22 in the last two years.
How many Citrix CVEs are in CISA KEV?: Yes — 24 of Citrix's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Citrix products have the most CVEs?: The Citrix products with the most published CVEs are hypervisor, XenServer, NetScaler Gateway, netscaler_application_delivery_controller, netscaler gateway firmware.
What are the most common weakness types in Citrix CVEs?: Citrix's CVEs most often map to these CWE weakness types: CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-476 (NULL Pointer Dereference).
Are there public exploits for Citrix vulnerabilities?: Yes — 70 of Citrix's CVEs have a known public exploit.
How many critical Citrix vulnerabilities are there?: Citrix has 83 critical and 189 high-severity CVEs.
What is the average severity of Citrix CVEs?: The average CVSS base score across Citrix's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Citrix vulnerabilities

Monitor new Citrix vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing