{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:29.173Z","products":["citrix"],"actNowTotal":4,"results":[{"query":"citrix","matched":5,"actNow":4,"events":[{"id":"kev-2026-09-27-citrix-netscaler","url":"https://securitythreatpulse.com/events/kev-2026-09-27-citrix-netscaler","title":"Citrix NetScaler: 2 flaws used in attacks; attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 44 days old, so many systems are likely still unpatched. Ready-made attack tools are public. It affects a product that faces the internet or gives remote access. The severity score is critical (9.5). The exploit prediction score is 82%.","tier":"now","rankScore":7,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","Ready-made attack tools are public.","3 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-88771","CVE-2026-88772"],"vendor":"Citrix","product":"NetScaler","affectedProducts":[{"kind":"direct","slug":"citrix/netscaler","vendor":"Citrix","product":"NetScaler","evidence":["kev"],"vendorKey":"citrix","productKey":"netscaler"},{"kind":"direct","slug":"citrix/adc","vendor":"Citrix","product":"ADC","evidence":["cpe"],"vendorKey":"citrix","productKey":"adc"},{"kind":"direct","slug":"citrix/gateway","vendor":"Citrix","product":"Gateway","evidence":["cpe"],"vendorKey":"citrix","productKey":"gateway"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.","cvss":9.5,"epss":0.81894,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-27","kevDueDate":"2026-09-30","firstSeenAt":"2026-09-27T00:00:00.000Z","updatedAt":"2026-11-10T20:00:05.612Z","newestEvidenceAt":"2026-11-04T23:22:01.000Z"},{"id":"kev-2026-10-04-citrix-netscaler","url":"https://securitythreatpulse.com/events/kev-2026-10-04-citrix-netscaler","title":"Citrix NetScaler: attackers can knock it offline","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 38 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access.","3 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-88779"],"vendor":"Citrix","product":"NetScaler","affectedProducts":[{"kind":"direct","slug":"citrix/netscaler","vendor":"Citrix","product":"NetScaler","evidence":["kev"],"vendorKey":"citrix","productKey":"netscaler"},{"kind":"direct","slug":"citrix/adc","vendor":"Citrix","product":"ADC","evidence":["cpe"],"vendorKey":"citrix","productKey":"adc"},{"kind":"direct","slug":"citrix/gateway","vendor":"Citrix","product":"Gateway","evidence":["cpe"],"vendorKey":"citrix","productKey":"gateway"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","cvss":8.7,"epss":0.11388,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-10-04","kevDueDate":"2026-10-07","firstSeenAt":"2026-10-04T00:00:00.000Z","updatedAt":"2026-11-11T03:00:05.469Z","newestEvidenceAt":"2026-11-04T12:39:55.363Z"},{"id":"kev-2026-09-09-citrix-netscaler","url":"https://securitythreatpulse.com/events/kev-2026-09-09-citrix-netscaler","title":"Citrix NetScaler: attackers can get in without a password","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 81 days old, so many systems are likely still unpatched. It affects a product that faces the internet or gives remote access. The severity score is critical (9.3).","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The product faces the internet or gives remote access."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-19490"],"vendor":"Citrix","product":"NetScaler","affectedProducts":[{"kind":"direct","slug":"citrix/netscaler","vendor":"Citrix","product":"NetScaler","evidence":["kev"],"vendorKey":"citrix","productKey":"netscaler"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","cvss":9.3,"epss":0.33262,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-09","kevDueDate":"2026-09-12","firstSeenAt":"2026-09-09T00:00:00.000Z","updatedAt":"2026-11-08T16:37:40.566Z","newestEvidenceAt":"2026-10-30T08:16:12.435Z"},{"id":"kev-2026-08-26-citrix-netscaler-adc-and-netscaler-ga","url":"https://securitythreatpulse.com/events/kev-2026-08-26-citrix-netscaler-adc-and-netscaler-ga","title":"Citrix NetScaler ADC and NetScaler Gateway: attackers can knock it offline","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 117 days old, so current versions are being attacked. It affects a product that faces the internet or gives remote access.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-8452"],"vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","affectedProducts":[{"vendorKey":"citrix","productKey":"netscaleradcandnetscalergateway","vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","slug":"citrix/netscaleradcandnetscalergateway","kind":"direct","evidence":["kev"]}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.","cvss":8.8,"epss":0.01011,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-08-26","kevDueDate":"2026-08-29","firstSeenAt":"2026-08-26T00:00:00.000Z","updatedAt":"2026-10-25T12:52:40.299Z","newestEvidenceAt":"2026-10-24T20:00:08.947Z"},{"id":"early-cve-2023-24488","url":"https://securitythreatpulse.com/events/early-cve-2023-24488","title":"Citrix ADC and Citrix Gateway: attackers can hijack users' sessions","verdict":"watch","verdictReason":"Attack attempts are confirmed, with no confirmed exploitation yet.","tier":null,"rankScore":4,"rankWhy":["The product faces the internet or gives remote access.","Ready-made attack tools are public.","The first report is 20 days old."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"none"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2023-24488"],"vendor":"Citrix","product":"Citrix ADC and Citrix Gateway ","affectedProducts":[{"kind":"direct","slug":"citrix/citrixadcandcitrixgateway","vendor":"Citrix","product":"Citrix ADC and Citrix Gateway","evidence":["cna","cpe"],"vendorKey":"citrix","productKey":"citrixadcandcitrixgateway"}],"category":{"id":"edge","label":"VPN, firewall or gateway","why":"It sits at the edge of your network and faces the internet, so attackers can reach it directly.","doThis":"If you have it, patch it today. If you cannot, block access to it from the internet until you can."},"summary":"Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting","cvss":6.1,"epss":0.81169,"exploitMaturity":"weaponized","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-10-22T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-10-24T23:23:07.970Z"}]}]}