This page collects publicly documented incidents involving Citrix / Cloud Software Group and security researchers. Every entry cites the original public source. Analytical observations are the researcher's own, based on the cited material. No private communications or anonymous sources are referenced.
A directory traversal vulnerability in Citrix ADC and Gateway allowed unauthenticated remote code execution. CVSS 9.8 Critical.
33 days between advisory and first patch. During this window, exploitation was active and the only defence was a mitigation workaround. CISA issued Alert AA20-031A with detection guidance.
The vulnerability was colloquially named "Shitrix" by the security community.
Sources: Citrix blog, NVD, CISA AA20-031A
An unauthenticated RCE vulnerability in NetScaler ADC and Gateway via stack buffer overflow. Exploited as a zero-day against critical infrastructure before Citrix was aware.
Sources: Citrix bulletin CTX561482, CISA AA23-201A
A buffer over-read vulnerability in NetScaler ADC and Gateway that leaked session tokens, enabling session hijacking and MFA bypass. Exploited by LockBit 3.0 and AlphV/BlackCat ransomware groups.
Mandiant later determined that exploitation of CVE-2023-4966 was the initial access vector for intrusions predating Citrix's patch release. CISA had to issue supplementary guidance because the vendor's own instructions did not adequately address session persistence after patching.
Sources: CISA AA23-325A, Cybersecurity Dive, Unit 42 threat brief
watchTowr disclosed vulnerabilities in Citrix Session Recording that they characterized as unauthenticated remote code execution. Citrix rated both CVEs as Medium (CVSS 5.1).
watchTowr stated the vulnerabilities could be exploited without authentication. Cloud Software Group stated that an attacker must be authenticated. The assigned CVSS score reflects Citrix's assessment. As their own CNA, Citrix's severity rating is authoritative within the CVE system.
The incident was covered by Cybersecurity Dive, The Register, and Dark Reading.
Sources: watchTowr disclosure, Citrix bulletin CTX691941, Cybersecurity Dive
An out-of-bounds read vulnerability in NetScaler ADC and Gateway - the same class of memory-safety vulnerability as the original CitrixBleed (CVE-2023-4966), discovered two years later. Pre-authentication, allows leaking session tokens and credentials from device memory.
CitrixBleed (2023) and CitrixBleed 2 (2025) are the same vulnerability class - memory over-read from insufficient input validation - in the same product line, two years apart. The root cause identified in the first incident was not addressed systemically. watchTowr's disclosure was titled "How Much More Must We Bleed?"
Sources: Citrix advisory CTX693420, watchTowr disclosure, Infosecurity Magazine
Cloud Software Group is a MITRE-authorized CNA for its own products. They assign their own CVE IDs and CVSS scores. A researcher who disagrees with the vendor's severity assessment has no recourse within the CVE system.
Source: Cloud Software Group vulnerability response policy
Cloud Software Group's HackerOne program explicitly excludes XenServer. The program scope covers Cloud/SaaS products only. The policy states: "coordinated disclosure reports do NOT qualify for bounty."
Source: HackerOne - Cloud Software Group program scope
In May 2024, Cloud Software Group signed CISA's Secure by Design pledge, committing to reduce entire classes of vulnerability across their products within one year.
Source: CISA Secure by Design pledge signatories
| Year | CVE | Class | CVSS | Notable |
|---|---|---|---|---|
| 2019 | CVE-2019-19781 | Directory traversal / RCE | 9.8 | 33 days to first patch; active exploitation during gap |
| 2023 | CVE-2023-3519 | Stack buffer overflow / RCE | 9.8 | Zero-day against critical infrastructure |
| 2023 | CVE-2023-4966 | Buffer over-read / session leak | 9.4 | CISA supplementary guidance; LockBit exploitation |
| 2024 | CVE-2024-8068/8069 | RCE (disputed auth requirements) | 5.1 (vendor) | Public severity dispute with watchTowr |
| 2025 | CVE-2025-5777 | Buffer over-read / session leak | 9.3 | Same class as CitrixBleed, two years later |