Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Citrix bug bounty programs

citrix.com Updated Part of Cloud

Citrix runs one public program: a HackerOne bug bounty paying up to $5,000.

Top reward
$5,000
HackerOne
Programs
1
1 pays cash
Targets in scope
17
5 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Citrix runs.

  • Cloud Software Group

    HackerOne · Bug bounty

    Open

    Top reward

    $5,000
    Critical
    $5,000
    High
    $2,000
    Medium
    $250
    Low
    –
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

17 targets. 16 excluded.

  • *.citrixworkspacesapi.net

    Wildcards Critical

  • *developer.cloud.com

    Wildcards No bounty

  • onboarding-*.cloud.com

    Wildcards Critical

  • accounts.cloud.com

    Web Critical

  • adm.cloud.com

    Web Critical

  • ap-s.cloud.com

    Web Critical

  • api.adm.cloud.com

    Web Critical

  • eu.cloud.com

    Web Critical

  • onboarding.cloud.com

    Web Critical

  • us.cloud.com

    Web Critical

  • Citrix Secure Access client for Android

    Android Critical

  • Citrix Secure Access client for macOS

    iOS Critical

  • Citrix End Point Analysis (EPA) client for Linux

    Products and areas Critical

  • Citrix End Point Analysis (EPA) client for Windows

    Products and areas Critical

  • Citrix Secure Access client for iOS

    Products and areas Critical

  • Citrix Secure Access client for Linux

    Products and areas Critical

  • Citrix Secure Access client for Windows

    Products and areas Critical

No target matches. Try part of a host name, such as the company name.

Out of scope 16

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.browser.cloud.com

  • *.citrix*.com

  • *.cloudburrito.com

  • *.podio.com

  • *.securevdr.com

  • *.xmdev.cloud.com

  • *.xmqa.cloud.com

  • *.xmtest.cloud.com

  • (youriwssubdomain).cloud.com

  • (yoursubdomain).ap.iws.cloud.com

  • (yoursubdomain).eu.iws.cloud.com

  • (yoursubdomain).us.iws.cloud.com

  • accounts-internal.cloud.com

  • citrix.cloud.com

  • launch.cloud.com

  • www.cloud.com

Recent changes

Reward and scope changes across every Citrix program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Citrix products, from the NVD.

Search NVD
  • CVE-2026-88779 High

    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

  • CVE-2026-88773 Critical

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.

  • CVE-2026-88774 High

    Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.

  • CVE-2026-88775 High

    Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

  • CVE-2026-88776 High

    Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service

  • CVE-2026-88777 High

    Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service

  • CVE-2026-88778 High

    Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.

  • CVE-2026-88771 Critical

    Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

About this page

This page gathers every public program listed under citrix.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.