Loading story…
Citrix disclosed and patched two vulnerabilities in its Windows client software, led by CVE-2026-53565, an improper privilege management flaw (CWE-269) that can let a low-privileged local user escalate to SYSTEM privileges. The issue affects Citrix Secure Access Client for Windows before 26.6.1.20 and Citrix Endpoint Analysis Client for Windows before 26.5.1.7, while a second flaw, CVE-2026-53566, is an out-of-bounds memory read that can expose sensitive memory contents under specific conditions and affects Secure Access Client for Windows before 26.6.1.20.
Citrix released fixed versions 26.6.1.20 for Secure Access Client and 26.5.1.7 for Endpoint Analysis Client, and the Canadian Centre for Cyber Security urged organizations to review Citrix’s bulletin and apply the recommended mitigations. Available reporting says there is no confirmed in-the-wild exploitation and no public proof-of-concept for either vulnerability at this time, but administrators are being told to update affected systems promptly.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On July 14, 2026, Citrix published security advisories covering CVE-2026-53565 and CVE-2026-53566 for two Windows products. Patched versions released were Citrix Secure Access Client for Windows 26.6.1.20 and Citrix Endpoint Analysis Client for Windows 26.5.1.7.
Citrix received a report of CVE-2026-53565 on July 14, 2026 via secure@citrix.com. The flaw is an improper privilege management issue affecting Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix released security updates for **NetScaler Console** and **NetScaler Agent** to fix **`CVE-2024-12284`**, a high-severity flaw with a **CVSS score of 8.8**. The vulnerability stems from improper privilege management and could let an authenticated attacker with access to a vulnerable system escalate privileges and execute commands remotely. Citrix published the issue through its support bulletin and a NetScaler security update, while national defenders including **CSIRT.SK** warned that organizations running local deployments should treat the issue as urgent. Affected releases include **NetScaler Console** and **NetScaler Agent** **14.1** versions earlier than **`14.1-38.53`** and **13.1** versions earlier than **`13.1-56.18`**. Citrix said its managed solutions had already been secured, but customer-managed instances require patching and hardening. Organizations were advised to upgrade immediately to **`13.1-56.18`**, **`14.1-38.53`**, or later, and to follow NetScaler Console secure-deployment best practices to reduce exposure.
Jul 24, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026