# Citrix

[7 tracked vendors](https://thirdpartyindex.com/vendors/citrix#used-by) name Citrix as a subprocessor, including [Experian](https://thirdpartyindex.com/vendors/experian), [Cushman & Wakefield](https://thirdpartyindex.com/vendors/cushman-and-wakefield) and [insightsoftware](https://thirdpartyindex.com/vendors/insightsoftware). We have not found a subprocessor list published by Citrix. We monitor 1 of its documents, which we last checked on 2026-11-11.

Citrix (citrix.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/citrix
- Documents last verified: 2026-11-11
- Transparency rating: 13/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 0/6 (not found); security.txt 0/6 (not found); Security page 5/5; Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 7 tracked vendors rely on it directly, 12 within two hops, 1926 within three
- Cite as: Citrix, Third Party Index, https://thirdpartyindex.com/vendors/citrix (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Security page | https://www.citrix.com/about/trust-center.html | 2026-11-11 | 2026-09-21 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Compliance

As its trust center lists them.

- FedRAMP Marketplace: Moderate · 7 agency authorizations · since Apr 18, 2022
- FedRAMP Marketplace: High

## Web Technologies

Citrix's homepage made 81 requests to 16 domains, 8 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-03 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

8 third parties by category: Analytics 3 (Google Cloud, ZoomInfo, Crazy Egg); Marketing automation 1 (usually detected as Marketing automation: Adobe); Cookie compliance 1 (TrustArc); CDN 1 (UNPKG); RUM 1 (usually detected as RUM: Akamai); Unclassified 1 (Oracle). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (8)

- Adobe: 7 requests to adobedtm.com
- Google Cloud: 7 requests to googletagmanager.com, youtube.com, google-analytics.com, storage.googleapis.com; Google Analytics, Google Tag Manager, YouTube
- TrustArc: 5 requests to trustarc.com; TrustArc
- ZoomInfo: 3 requests to zi-scripts.com, zoominfo.com; Zoominfo
- Akamai: 2 requests to go-mpulse.net
- Oracle: 2 requests to eloqua.com, en25.com
- UNPKG: 2 requests to unpkg.com; Unpkg, web-vitals 3
- Crazy Egg: 1 request to crazyegg.com; Crazy Egg

### Unknown (1)

Domains not identified yet: a3.ag

### First party (1)

- Citrix: 51 requests to citrix.com, cedexis.com; Adobe Experience Manager, Adobe Experience Platform Launch, Akamai, Akamai mPulse, Apache HTTP Server, Boomerang, Eloqua, HSTS, Isotope, Java, Masonry, Open Graph, PWA, core-js 3.2.1, jQuery 1.12.4, lit-element 2.3.1, lit-html 1.2.1

6 tracked companies loaded by the homepage are not in Citrix's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (7)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [CrashPlan](https://thirdpartyindex.com/vendors/crashplan.md)
- [Cushman & Wakefield](https://thirdpartyindex.com/vendors/cushman-and-wakefield.md)
- [Edmentum](https://thirdpartyindex.com/vendors/edmentum.md): Customer reporting and file sharing
- [EVERSANA](https://thirdpartyindex.com/vendors/eversana.md)
- [Experian](https://thirdpartyindex.com/vendors/experian.md): Citrix DaaS (Desktops-as-a-Service) provides desktop virtualization allowing access to the Experian network and systems. Provision of maintenance and support fo…
- [insightsoftware](https://thirdpartyindex.com/vendors/insightsoftware.md): Remote desktop and virtualization services
- [Lightedge](https://thirdpartyindex.com/vendors/lightedge.md)

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 27 vulnerabilities in its software:

- CVE-2026-88779 (NetScaler), listed 2026-10-04: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-88771 (NetScaler), listed 2026-09-27: Citrix NetScaler Improper Input Validation Vulnerability
- CVE-2026-88772 (NetScaler), listed 2026-09-27: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-19490 (NetScaler), listed 2026-09-09: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
- CVE-2026-8452 (NetScaler ADC and NetScaler Gateway), listed 2026-08-26: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-3055 (NetScaler), listed 2026-03-30: Citrix NetScaler Out-of-Bounds Read Vulnerability
- CVE-2025-7775 (NetScaler), listed 2025-08-26: Citrix NetScaler Memory Overflow Vulnerability
- CVE-2024-8068 (Session Recording), listed 2025-08-25: Citrix Session Recording Improper Privilege Management Vulnerability
- CVE-2024-8069 (Session Recording), listed 2025-08-25: Citrix Session Recording Deserialization of Untrusted Data Vulnerability
- CVE-2025-5777 (NetScaler ADC and Gateway), listed 2025-07-10: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability (known ransomware use)
- CVE-2025-6543 (NetScaler ADC and Gateway), listed 2025-06-30: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
- CVE-2023-6548 (NetScaler ADC and NetScaler Gateway), listed 2024-01-17: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- CVE-2023-6549 (NetScaler ADC and NetScaler Gateway), listed 2024-01-17: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- CVE-2023-4966 (NetScaler ADC and NetScaler Gateway), listed 2023-10-18: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability (known ransomware use)
- CVE-2023-24489 (Content Collaboration), listed 2023-08-16: Citrix Content Collaboration ShareFile Improper Access Control Vulnerability
- CVE-2023-3519 (NetScaler ADC and NetScaler Gateway), listed 2023-07-19: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability (known ransomware use)
- CVE-2022-27518 (Application Delivery Controller (ADC) and Gateway), listed 2022-12-13: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability
- CVE-2017-6316 (NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server), listed 2022-03-25: Citrix Multiple Products Remote Code Execution Vulnerability
- CVE-2019-12989 (SD-WAN and NetScaler), listed 2022-03-25: Citrix SD-WAN and NetScaler SQL Injection Vulnerability
- CVE-2019-12991 (SD-WAN and NetScaler), listed 2022-03-25: Citrix SD-WAN and NetScaler Command Injection Vulnerability
- CVE-2021-22941 (ShareFile), listed 2022-03-25: Citrix ShareFile Improper Access Control Vulnerability (known ransomware use)
- CVE-2019-11634 (Workspace Application and Receiver for Windows), listed 2021-11-03: Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability (known ransomware use)
- CVE-2019-13608 (StoreFront Server), listed 2021-11-03: Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability (known ransomware use)
- CVE-2019-19781 (Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance), listed 2021-11-03: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability (known ransomware use)
- CVE-2020-8193 (Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance), listed 2021-11-03: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
- CVE-2020-8195 (Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance), listed 2021-11-03: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
- CVE-2020-8196 (Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance), listed 2021-11-03: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api