watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 Detection Artifact Generator for Citrix NetScaler CVE-2026-88771 See our blog post for technical details. Detection in Action ./watchTowr-vs-Citrix-Netscaler-CVE-2026-88771.py --target https://netscaler.local/ --command 'id/var/tmp/watchTowr' / | | |\ ...

Citrix ADC and Citrix NetScaler Gateway - Remote Code Injection

Citrix ADC and NetScaler Gateway are susceptible to remote code injection. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are before 13.0-58.30,...

watchTowr-vs-Netscaler-CVE-2026-8451

CVE-2026-8451 Citrix Netscaler memory overread Citrix Netscaler overread Detection Artifact Generator Tool! Detection in Action This Detection Artifact Generator will accept a target Netscaler device, and attempt to leak memroy via CVE-2026-8451. All it needs is the target system. Include the...

Citrix-cve-2025-6543

Citrix CVE-2025-6543 Script to check if Citrix is vulnerable to CVE-2025-6543 citrix-cve-2025-6543-check.py is a Python 3 command-line script that identifies NetScaler ADC / Gateway instances vulnerable to the CVE-2025-6543 memory overflow published by Citrix in June 2025. Designed for pentesters...

netscaler-ctx697096-checker

NetScaler checker for CTX697096, CTX697174 and CTX697191 Read-only precondition and exposure checker for the Citrix NetScaler ADC / NetScaler Gateway security bulletin CTX697096 , covering CVE-2026-88771 through CVE-2026-88778 , and for CTX697174 , covering CVE-2026-88779 the SAML crash attack, a...

CVE-2023-4966

CVE-2023-4966 Exploit Script CVE-2023-4966 - NetScaler ADC and NetScaler Gateway Memory Leak Exploit Usage: usage: python banner.py optional arguments: -h, --help show this help message and exit --target TARGET The Citrix ADC / Gateway target, excluding the protocol e.g. 192.168.1.200...

citrix_dir_traversal_rce

citrixdirtraversalrce A directory traversal was discovered in Citrix Application Delivery Controller ADC, aka NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. When the NSPPE receives a request for GET /vpn/index.html, it is supposed to send this request to Apache, which processes it...

CVE-2025-5777

🩸 CVE-2025-5777 - CitrixBleed 2 Memory Disclosure Vulnerability in Citrix NetScaler / ADC 📌 1. Executive Summary CitrixBleed 2 refers to a critical memory disclosure vulnerability affecting: 🏢 Citrix NetScaler ADC 🌐 NetScaler Gateway 🔐 Internet-facing VPN appliances It allows unauthenticated...

CVE-2025-12101-Scanner-PoC

CVE-2025-12101 Scanner Multi-threaded vulnerability scanner for CVE-2025-12101 - Citrix NetScaler XSS via SAML RelayState. Overview CVE-2025-12101 is a reflected XSS vulnerability in Citrix NetScaler ADC and Gateway products affecting the /cgi/logout endpoint through the RelayState parameter. CVS...

Vulnerability handling in Citrix NetScaler ADC and Gateway

Citrix has identified a vulnerability in NetScaler ADC and Gateway products when these are configured as SAML Service Providers SPs or Identity Providers IdPs. The vulnerability involves a memory overflow that occurs during the processing of SAML messages. This vulnerability can be activated...

EUVD-2026-95315

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only...

CVE-2026-107406

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only...

CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only...

CVE-2026-107406

A memory overflow vulnerability exists in NetScaler ADC and NetScaler Gateway when configured as a SAML SP or SAML IdP . This flaw can lead to Remote Code Execution (RCE) or a Denial of Service (DoS) . The vulnerability impacts various versions, including NetScaler ADC and Gateway versions before...

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406

Severity - Critical Description of Problem A vulnerability has been discovered in Citrix NetScaler ADC formerly Citrix ADC and Citrix NetScaler Gateway formerly Citrix Gateway. Refer below for further details. Affected Versions: The following supported versions of Citrix NetScaler ADC and Citrix...

CVE-2026-3055

CVE-2026-3055 - Security Vulnerability Severity: N/A CVSS: N/A Impact: N/A Published: 2026-03-23 Legal For authorized security testing only. Root Cause short version Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread...

PT-2026-108214

Name of the Vulnerable Software and Affected Versions NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37 NetScaler ADC 14.1-FIPS versions prior to 14.1-73.37 FIPS NetScaler ADC and NetScaler Gateway versions 14.1-73.37 through 14.1-73.41 NetScaler ADC 14.1-FIPS versions 14.1-73.37...

citrix-netscaler-cve-2026-88771-iocs

Citrix NetScaler CVE-2026-88771: Indicators of Compromise Indicators of Compromise IoCs observed by watchTowr Intel during in-the-wild exploitation of CVE-2026-88771, an unauthenticated command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Indicators in this repository we...

NetScaler ADC and NetScaler Gateway DoS (CTX697174)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-64.28, or 14.1 prior to 14.1-73.41, or 13.1-FIPS/NDcPP prior to 13.1-37.282, or 14.1-FIPS prior to 14.1-73.41. It is, therefore, affected by multiple vulnerabilities: - Citrix...

⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter...