https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Citrix.Sun, 26 Jul 2026 22:32:51 GMThttps://thehackernews.com/2026/07/weekly-recap-sharefile-threat-citrix.htmlcst-2414A weekly security recap highlights multiple threats including ShareFile vulnerabilities, Citrix Bleed 2 ransomware activity, and AI-powered coding attacks. The piece emphasizes that while security tools automate vulnerability discovery, attackers similarly leverage automation to find and exploit weaknesses, and many organizations remain unpatched against known issues from prior years.Mon, 13 Jul 2026 15:05:57 GMThttps://helpnetsecurity.com/2026/07/09/citrix-mcp-gatewaycst-2259Citrix announced new MCP Gateway functionality for its NetScaler platform that enables enterprises to securely route, govern, and observe traffic to Model Context Protocol servers. The update also includes enhancements to NetScaler AI Gateway for improved model routing and token-level usage tracking on large language model traffic.Thu, 09 Jul 2026 13:49:56 GMThttps://darkreading.com/vulnerabilities-threats/citrixbleed-ing-again-netscaler-vulnerability-under-attackcst-490A new memory disclosure vulnerability in Citrix NetScaler products is being actively exploited by attackers following the release of a proof-of-concept exploit by researchers. The flaw allows unauthorized access to sensitive data stored in memory.Mon, 06 Jul 2026 21:17:42 GMThttps://research.checkpoint.com/2026/6th-july-threat-intelligence-report-2cst-594A threat intelligence bulletin reports multiple significant incidents across sectors: ransomware attacks affecting financial, defense, manufacturing, and insurance organizations; artificial intelligence threats including LLM-generated ransomware, unsafe coding agents, and phishing domain hijacking; and critical vulnerabilities in Oracle, Linux, Citrix, and Progress products with active exploitation observed.Mon, 06 Jul 2026 12:01:54 GMThttps://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.htmlcst-33Anubis ransomware operators are exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) to gain initial access to targets. The group employs common tactics including legitimate Remote Management and Monitoring tools, credential harvesting, and manual lateral movement techniques.Thu, 02 Jul 2026 18:30:33 GMThttps://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.htmlcst-56Citrix released security updates on Tuesday addressing six vulnerabilities in NetScaler ADC and NetScaler Gateway, including flaws that could allow arbitrary file reads or denial-of-service attacks. The vulnerabilities stem from issues such as insufficient input validation, with at least one flaw rated at CVSS 8.8.Wed, 01 Jul 2026 03:54:22 GMThttps://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451cst-555Citrix has publicly disclosed CVE-2026-8451, a memory overread vulnerability in NetScaler devices that allows unauthenticated access to sensitive information. This marks another instance in a recurring pattern of memory disclosure vulnerabilities affecting NetScaler appliances, which the researcher refers to as part of the broader CitrixBleed class of issues. The vulnerability demonstrates ongoing memory management weaknesses in a critical appliance used for load balancing, SSL termination, and remote access across enterprise networks.Tue, 30 Jun 2026 19:35:58 GMThttps://recordedfuture.com/blog/march-2026-cve-landscapecst-1981Insikt Group identified 31 high-impact vulnerabilities actively exploited in March 2026, with 29 rated as very critical. The affected products span major vendors including Cisco, Microsoft, Google, ConnectWise, Citrix, and others, with Microsoft and Apple accounting for approximately 32% of the total. Notable findings include the Interlock ransomware group exploiting a Cisco Firewall Management Center zero-day, the continued exploitation of a nine-year-old Hikvision vulnerability, and public proof-of-concept exploits available for 10 of the 31 vulnerabilities.Mon, 13 Apr 2026 00:00:00 GMThttps://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701cst-561Researchers discovered and chained two vulnerabilities in Progress ShareFile's Storage Zone Controller (an on-premises gateway managing file transfers) to achieve unauthenticated remote code execution. The flaws, CVE-2026-2699 (authentication bypass) and CVE-2026-2701 (remote code execution), affected version 5.12.3 on the ASP.NET branch and were patched in version 5.12.4 released March 10, 2026. Approximately 30,000 Storage Zone Controller instances are exposed on the internet.Thu, 02 Apr 2026 10:00:42 GMThttps://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746cst-562A 32-year-old pre-authentication remote code execution vulnerability (CVE-2026-32746) was discovered in GNU inetutils Telnetd by the DREAM Security Research Team. The BSS-based buffer overflow exists in the LINEMODE SLC negotiation handler and affects multiple operating systems and distributions that derive from the same codebase, including Ubuntu, Debian, FreeBSD, NetBSD, and others. Despite the severity and wide impact, the vulnerability had received minimal public analysis at the time of reporting.Thu, 19 Mar 2026 20:21:07 GMThttps://greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poccst-1895GreyNoise detected active exploitation of CVE-2025-5777, a memory overread vulnerability in Citrix NetScaler, starting June 23, approximately two weeks before a public proof-of-concept was publicly released on July 4. This indicates attackers had access to exploitation knowledge or techniques ahead of public disclosure.Wed, 16 Jul 2025 00:00:00 GMThttps://wiz.io/blog/critical-vulnerabilities-netscaler-adc-exploited-in-the-wild-cve-2025-5777cst-1448Three critical vulnerabilities affecting Citrix NetScaler ADC and Gateway devices are being actively exploited in the wild. Organizations should apply patches immediately to mitigate the identified CVEs (2025-5349, 2025-5777, and 2025-6543).Sun, 06 Jul 2025 12:45:49 GMThttps://huntress.com/blog/netscaler-exploitation-to-social-engineering-mapping-convergence-of-adversary-tradecraft-across-victimscst-1035Huntress team analyzed recent intrusions linked to Netscaler exploitation, examining the attack chain and techniques used by threat actors. The analysis documents how attackers leveraged the vulnerability to establish initial access and conduct follow-on operations.Tue, 26 Sep 2023 00:00:00 GMThttps://wiz.io/blog/cve-2022-27518-exploited-in-the-wild-by-apt5-everything-you-need-to-knowcst-1766CVE-2022-27518 is an unauthenticated remote code execution vulnerability affecting Citrix ADC and Gateway that has been exploited in active attacks by the nation state actor APT5. Organizations running affected Citrix products face immediate risk and should prioritize patching.Tue, 13 Dec 2022 21:03:18 GMT