Citrix

CVE-2026-8452 is a critical pre-authentication heap overflow in the Citrix NetScaler AAA service, reachable when SAML is configured, allowing for remote code execution via publicly available exploit code.

A security policy bypass vulnerability in Citrix XenServer versions 8.4 and 9 allows attackers to circumvent established security controls, as detailed in Citrix bulletin CTX697257.

Citrix has released security bulletins addressing multiple vulnerabilities across UniconOS and XenServer products, including CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701.

A local attacker can exploit a vulnerability in Citrix Systems XenServer and Xen, tracked as CVE-2024-45815, to gain unauthorized access to sensitive information via improper security controls in the virtualization layer.

CISA has added CVE-2026-88779, a memory buffer vulnerability in Citrix NetScaler, to the Known Exploited Vulnerabilities (KEV) catalog due to confirmed in-the-wild exploitation.

CISA has added two Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog due to documented evidence of active in-the-wild exploitation.

Citrix has released patches for critical vulnerabilities including CVE-2026-19490, an authentication bypass, and CVE-2026-19489, a memory overflow vulnerability affecting NetScaler ADC and Gateway appliances.

A local privilege escalation vulnerability in Citrix Workspace App for macOS allows a local attacker to elevate their system permissions.

Multiple vulnerabilities have been discovered in various Citrix products, including Endpoint Analysis Client, Secure Access Client, XenCenter SDK client, and XenCenter. These flaws allow an attacker to achieve privilege escalation, compromise data confidentiality, and bypass security policies.

Initial Access Brokers are actively exploiting CitrixBleed 2 (CVE-2025-5777) on NetScaler appliances to steal session tokens, achieve local privilege escalation, establish persistence via legitimate remote access tools, and ultimately deploy Dragonforce ransomware.

The rule detects the execution of the built-in Windows Installer, msiexec.exe, to install a remote package potentially abused by adversaries for initial access and defense evasion.

Multiple vulnerabilities exist in Xen and Citrix Systems XenServer that could allow an attacker to escalate privileges, bypass security measures, modify and disclose data, or cause a denial-of-service condition.

Citrix released security advisory AV26-400 on April 28, 2026, addressing vulnerabilities in XenServer versions prior to 8.4, prompting users to apply mitigations.

Threat actors are actively exploiting CVE-2026-3055, a critical memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML identity provider (IDP), to extract sensitive information, including authenticated administrative session IDs, potentially leading to full system takeover.

A critical remote code execution vulnerability, CVE-2026-33017, exists in Langflow AI pipelines prior to version 1.9.0 that allows an unauthenticated remote attacker to execute code with full server process privileges, impacting availability, integrity, and confidentiality.

Adversaries may establish persistence by abusing the Windows Installer (msiexec.exe) to create scheduled tasks or modify registry run keys, allowing for malicious code execution upon system startup or user logon.

A race condition vulnerability in NetScaler ADC and Gateway (CVE-2026-3055 and CVE-2026-4368) could lead to user session mixup, potentially allowing unauthorized access to sensitive information.

Exploitation attempts against Citrix ADC via CVE-2023-3519, a SAML processing overflow, detected through specific POST requests, could lead to arbitrary code execution, privilege escalation, or service disruption.

Detects the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe to bypass defenses by proxying execution of malicious content with signed binaries.

Adversaries may modify the network logon provider registry to register a rogue network logon provider module for persistence and credential access by intercepting authentication credentials in clear text during user logon.

Exploitation of CVE-2025-5777 (CitrixBleed 2) in Citrix NetScaler ADC and Gateway leads to memory disclosure by sending crafted POST requests to the /p/u/doAuthentication.do endpoint, potentially leaking session tokens and authentication materials.

Exploitation of CVE-2023-4966, known as Citrix Bleed, allows unauthorized data disclosure via the /oauth/idp/.well-known/openid-configuration endpoint, leading to session token theft and potential unauthorized access.

Attackers abuse the Application Shim functionality in Windows by using `sdbinst.exe` with malicious arguments to achieve persistence and execute arbitrary code within legitimate Windows processes.