Citrix NetScaler known exploited vulnerabilities, ranked
CISA lists 5 Citrix NetScaler CVEs as exploited in the wild. 4 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2026-19490: EPSS 23.2%, added 2026-09-09
- CVE-2025-7775: EPSS 19.6%, added 2025-08-26
- CVE-2026-3055: EPSS 4.0%, added 2026-03-30
- CVE-2026-88772: EPSS 1.3%, added 2026-09-27
- CVE-2026-88771: EPSS 1.1%, added 2026-09-27
All 5 Citrix NetScaler CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-19490 | NetScaler Authentication Bypass Using an Alternate Path or Channel | 23.2% | – | 2026-09-09 | 2026-09-12 |
| 2 | CVE-2025-7775 | NetScaler Memory Overflow | 19.6% | – | 2025-08-26 | 2025-08-28 |
| 3 | CVE-2026-3055 | NetScaler Out-of-Bounds Read | 4.0% | – | 2026-03-30 | 2026-04-02 |
| 4 | CVE-2026-88772 | NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer | 1.3% | – | 2026-09-27 | 2026-09-30 |
| 5 | CVE-2026-88771 | NetScaler Improper Input Validation | 1.1% | – | 2026-09-27 | 2026-09-30 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Citrix KEV CVEs · other Citrix products: NetScaler ADC and NetScaler Gateway · free KEV badge for Citrix · all vendors