VendorsEdge
Citrix
Citrix, part of Cloud Software Group, makes NetScaler ADC and NetScaler Gateway appliances, Citrix Virtual Apps and Desktops, Workspace app, Session Recording and ShareFile.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 2 Oct 2026
- Incidents on record
- 9
Response to exploited bugs
82 range 73–92rank 3 of 10
Provisional 4 reviewed zero-days. Not enough yet for a firm grade.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: B+ (82), provisional, from 4 reviewed zero-days in the last 36 months. Likely range 73 to 92.
- First fix within a day for 2 of 4 zero-days. The other 2 took a median of 28 hours, longest 32 hours.
- Every supported version fixed within a day for 2 of 4 zero-days. The other 2 took a median of 28 hours, longest 32 hours.
- First advisory within a day for 3 of 4 zero-days. The other one took 25 hours. Its advisory said the bug was being exploited in 3 of 4.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
- 5 of 9 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For one of them, our research notes record that the vendor initially disputed the exploitation reports.
Response to exploited bugs: sub-scores
- Time to first advisory3 of 4 zero-days within a day, longest 25 hours84B+4 cases, low confidence, weight 20%
- Time to first fix2 of 4 zero-days within a day, longest 32 hours85B+4 cases, low confidence, weight 40%
- Time to fix all versions2 of 4 zero-days within a day, longest 32 hours85B+4 cases, low confidence, weight 30%
- OpennessNo machine-readable advisory feed listed. 4 of 4 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 4 of 4 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.59C−10 cases, medium confidence, weight 10%
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Median of 4 graded zero-days. Vendor statement <1h, first fix 12h, all versions 12h.
Compressed time scale
Counts toward the response grade 4
- 2 Oct 2026NetScaler ADC and Gateway SAML memory overflow exploited for denial of service
- 26 Sep 2026NetScaler ADC and Gateway zero-day RCE pair (input validation and DTLS memory overflow)
- 26 Aug 2025NetScaler ADC and Gateway memory overflow RCE exploited at disclosure (August 2025)
- 25 Jun 2025NetScaler ADC and Gateway memory overflow exploited as a zero-day (June 2025)
Not graded 5: n-days, unreviewed timelines and end-of-life products
- 19 Aug 2026NetScaler ADC and Gateway authentication bypass via alternate path (SAML/AAA)Not graded: n-day
- 30 Jun 2026NetScaler ADC and Gateway memory overflow (Gateway/AAA) later exploited for RCENot graded: n-day
- 23 Mar 2026NetScaler ADC and Gateway SAML IdP memory overread ("CitrixBleed 3")Not graded: n-day
- 17 Jun 2025NetScaler ADC and Gateway out-of-bounds memory read ("CitrixBleed 2")Not graded: n-day
- 12 Nov 2024Citrix Session Recording deserialization RCE and privilege escalationNot graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
9 in 24 months, 1 with known ransomware use, 44% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 2 Oct 2026 | NetScaler ADC and Gateway SAML memory overflow exploited for denial of serviceCVE-2026-88779 | 8.7 | <1h | 32h | 32h | Fixed | Counts toward grade |
| 26 Sep 2026 | NetScaler ADC and Gateway zero-day RCE pair (input validation and DTLS memory overflow)CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778 | 9.5 | 25h | 25h | 25h | Fixed | Counts toward grade |
| 19 Aug 2026 | NetScaler ADC and Gateway authentication bypass via alternate path (SAML/AAA)CVE-2026-19490, CVE-2026-19489 | 9.3 | 0h | same day | same day | Fixed | Not graded: n-day |
| 30 Jun 2026 | NetScaler ADC and Gateway memory overflow (Gateway/AAA) later exploited for RCECVE-2026-8452, CVE-2026-8451, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474 | 8.8 | 0h | same day | same day | Fixed | Not graded: n-day |
| 23 Mar 2026 | NetScaler ADC and Gateway SAML IdP memory overread ("CitrixBleed 3")CVE-2026-3055, CVE-2026-4368 | 9.3 | 0h | same day | same day | Fixed | Not graded: n-day |
| 26 Aug 2025 | NetScaler ADC and Gateway memory overflow RCE exploited at disclosure (August 2025)CVE-2025-7775, CVE-2025-7776, CVE-2025-8424 | 9.2 | 0h | same day | same day | Fixed | Counts toward grade |
| 25 Jun 2025 | NetScaler ADC and Gateway memory overflow exploited as a zero-day (June 2025)CVE-2025-6543 | 9.2 | 0h | same day | same day | Fixed | Counts toward grade |
| 17 Jun 2025 | NetScaler ADC and Gateway out-of-bounds memory read ("CitrixBleed 2")CVE-2025-5777, CVE-2025-5349 | 9.3 | 0h | same day | same day | Fixed | Not graded: n-day |
| 12 Nov 2024 | Citrix Session Recording deserialization RCE and privilege escalationCVE-2024-8069, CVE-2024-8068 | 5.1 | 0h | same day | same day | Fixed | Not graded: n-day |
Private reports
None in the window
Bugs reported privately to Citrix by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Grade history
Response to exploited bugs: score at the end of each month.
05010082 B+
Show as a table
| Month | Score | Grade |
|---|---|---|
| Nov 2025 | – | NR |
| Dec 2025 | – | NR |
| Jan 2026 | – | NR |
| Feb 2026 | – | NR |
| Mar 2026 | – | NR |
| Apr 2026 | – | NR |
| May 2026 | – | NR |
| Jun 2026 | – | NR |
| Jul 2026 | – | NR |
| Aug 2026 | – | NR |
| Sep 2026 | 80 | B+ |
| Oct 2026 | 82 | B+ |
Channels
Get Citrix's own alerts
- EmailCitrix security bulletin alertsSign up for the vendor’s security notification emails.
- XCitrix on XFollow the account and turn on notifications.
- BlogNetScaler blog (sitemap)Subscribe to the security blog.
- BlogCitrix community 'Security Updates' blogSubscribe to the security blog.
- Advisory pageCitrix security bulletins via the support.citrix.com sitemapCheck the advisory page. It has no push channel.
- Advisory pageCitrix security bulletin listCheck the advisory page. It has no push channel.
What we watch
- Advisory pageCitrix security bulletins via the support.citrix.com sitemap
See sources and health for when each was last read.
Grade B plus.