Citrix NetScaler ADC and NetScaler Gateway known exploited vulnerabilities, ranked
CISA lists 5 Citrix NetScaler ADC and NetScaler Gateway CVEs as exploited in the wild. 1 were added in the last 12 months and 2 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2023-4966: EPSS 100.00%, used in ransomware, added 2023-10-18
- CVE-2023-3519: EPSS 99.75%, used in ransomware, added 2023-07-19
- CVE-2023-6549: EPSS 57.6%, added 2024-01-17
- CVE-2023-6548: EPSS 3.2%, added 2024-01-17
- CVE-2026-8452: EPSS 1.0%, added 2026-08-26
All 5 Citrix NetScaler ADC and NetScaler Gateway CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-4966 | NetScaler ADC and NetScaler Gateway Buffer Overflow | 100.00% | Yes | 2023-10-18 | 2023-11-08 |
| 2 | CVE-2023-3519 | NetScaler ADC and NetScaler Gateway Code Injection | 99.75% | Yes | 2023-07-19 | 2023-08-09 |
| 3 | CVE-2023-6549 | NetScaler ADC and NetScaler Gateway Buffer Overflow | 57.6% | – | 2024-01-17 | 2024-02-07 |
| 4 | CVE-2023-6548 | NetScaler ADC and NetScaler Gateway Code Injection | 3.2% | – | 2024-01-17 | 2024-01-24 |
| 5 | CVE-2026-8452 | NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer | 1.0% | – | 2026-08-26 | 2026-08-29 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Citrix KEV CVEs · other Citrix products: NetScaler · free KEV badge for Citrix · all vendors