Netscaler Gateway vulnerabilities

• netscaler gateway Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header CVE-2026-110719 6.9 MediumOctober 14, 2026
• netscaler adc, gateway +1 more Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVE-2026-107406 Public exploit 9.5 CriticalOctober 8, 2026
• citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more Memory overflow vulnerability leading to Denial of Service CVE-2026-88779 In KEV EPSS 11.4% 8.7 HighOctober 4, 2026
• codesys gateway, development system 3, edge gateway for linux +5 more +7 more Uncontrolled Memory Allocation in CODESYS Gateway Client CVE-2026-76992 8.7 HighSeptember 30, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more TCP Initial Sequence Number (ISN) prediction CVE-2026-88778 Public exploit 8.8 HighSeptember 27, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service CVE-2026-88777 Public exploit 8.8 HighSeptember 27, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service CVE-2026-88776 Public exploit 8.8 HighSeptember 27, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service CVE-2026-88775 Public exploit 8.8 HighSeptember 27, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more HTTP Request Smuggling CVE-2026-88773 Public exploit 9.3 CriticalSeptember 27, 2026
• citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more Feature policy bypass due to improper HTTP URL based expression usage CVE-2026-88774 Public exploit 7.0 HighSeptember 27, 2026
• citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 more Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVE-2026-88772 In KEVPublic exploit EPSS 76.6% 9.5 CriticalSeptember 27, 2026
• citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 more A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVE-2026-88771 In KEVPublic exploit EPSS 81.9% 9.5 CriticalSeptember 27, 2026
• netscaler gateway Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* CVE-2026-82270 8.7 HighAugust 28, 2026
• citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 CVE-2026-19490 In KEVPublic exploit EPSS 33.3% 9.3 CriticalAugust 19, 2026
• netscaler adc, gateway +1 more Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through... CVE-2026-19489 Public exploit 8.8 HighAugust 19, 2026
• envoyproxy gateway Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode CVE-2026-53714 Fix available 7.4 HighJuly 16, 2026
• envoyproxy gateway Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure CVE-2026-53713 Fix available 9.1 CriticalJuly 16, 2026
• envoyproxy gateway Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock CVE-2026-53715 Fix available 5.3 MediumJuly 16, 2026
• envoyproxy gateway Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header CVE-2026-53717 Fix available 6.5 MediumJuly 16, 2026
• envoyproxy gateway Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization CVE-2026-53719 Fix available 6.5 MediumJuly 16, 2026
• envoyproxy gateway Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit CVE-2026-53716 Fix available 6.5 MediumJuly 16, 2026
• envoyproxy gateway Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass CVE-2026-53718 Fix available 6.4 MediumJuly 16, 2026
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Denial of service via malformed HTTP/2 requests CVE-2026-13474 8.7 HighJune 30, 2026
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Insufficient input validation leading to memory overread CVE-2026-10817 Public exploit 6.9 MediumJune 30, 2026
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Arbitrary File Read (Unauthenticated) CVE-2026-10816 7.1 HighJune 30, 2026
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service CVE-2026-8655 8.8 HighJune 30, 2026
• citrix netscaler adc and netscaler gateway, netscaler gateway, netscaler adc +2 more +4 more Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service CVE-2026-8452 In KEVPublic exploit 8.8 HighJune 30, 2026
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Insufficient input validation leading to memory overread CVE-2026-8451 Public exploit EPSS 14.2% 8.8 HighJune 30, 2026
• citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more Insufficient input validation leading to memory overread CVE-2026-3055 In KEVPublic exploit EPSS 91.5% 9.3 CriticalMarch 23, 2026
• netscaler adc, gateway +1 more Race Condition leading to User Session Mixup CVE-2026-4368 7.7 HighMarch 23, 2026
• @apollo gateway, federation-internals, query-planner +2 more Apollo Federation has prototype pollution via incomplete key sanitization CVE-2026-32621 Public exploitFix available 9.9 CriticalMarch 13, 2026
• envoyproxy gateway, red hat connectivity link 1 +1 more Envoy Extension Policy lua scripts injection causes arbitrary command execution CVE-2026-22771 Fix available 8.8 HighJanuary 12, 2026
• netscaler gateway Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host CVE-2025-66405 Fix available 6.9 MediumDecember 1, 2025
• netscaler adc, gateway +1 more Cross-Site Scripting (XSS) CVE-2025-12101 Public exploit EPSS 26.2% 5.9 MediumNovember 11, 2025
• netscaler adc, gateway +1 more Improper access control on the NetScaler Management Interface CVE-2025-8424 8.7 HighAugust 26, 2025
• citrix netscaler gateway, netscaler adc, gateway +1 more +3 more Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service CVE-2025-7776 8.8 HighAugust 26, 2025
• citrix netscaler, netscaler gateway, netscaler adc +2 more +4 more Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service CVE-2025-7775 In KEVPublic exploit EPSS 20.7% 9.2 CriticalAugust 26, 2025
• citrix netscaler gateway, netscaler adc, gateway +2 more +4 more Memory overflow vulnerability leading to unintended control flow and Denial of Service CVE-2025-6543 In KEVPublic exploit EPSS 10.4% 9.2 CriticalJune 25, 2025
• citrix netscaler gateway, netscaler adc, gateway +2 more +4 more NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread CVE-2025-5777 In KEVPublic exploit EPSS 100.0% 9.3 CriticalJune 17, 2025
• envoyproxy gateway Envoy Gateway Log Injection Vulnerability CVE-2025-25294 Fix available 5.3 MediumMarch 6, 2025
• envoyproxy gateway Envoy Admin Interface Exposed through prometheus metrics endpoint CVE-2025-24030 Fix available 7.1 HighJanuary 23, 2025
• budgetcontrol gateway Auth Token can be passed dummy or wrong the middleware response is 200 OK CVE-2024-52528 9.3 CriticalNovember 15, 2024
• citrix netscaler adc, netscaler gateway, netscaler adc +2 more +4 more Authenticated user can access unintended user capabilities CVE-2024-8535 5.8 MediumNovember 12, 2024
• citrix netscaler adc, netscaler adc, gateway +5 more +7 more Memory safety vulnerability leading to memory corruption and Denial of Service CVE-2024-8534 8.4 HighNovember 12, 2024
• citrix netscaler adc, netscaler gateway, netscaler adc +2 more +4 more Denial of Service CVE-2024-5491 7.2 HighJuly 10, 2024
• devolutions gateway Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and... CVE-2023-1580 7.5 HighMarch 22, 2023