Record WatchRecord
Citrix broke into the most-exploited vendors of the last 90 days
11 October 2026 · Timeframe: Trailing 90 days vs the preceding 90
Citrix is now among the top 15 vendors by CISA-KEV listings over the last 90 days, after not making that list in the preceding 90. A vendor rising quarter-over-quarter means its exploited footprint is growing right now, not decades ago.
Why it matters
A trailing-90-day view of the most-exploited vendors is the timely version of this signal: it surfaces what attackers are actively working, not a legacy all-time average dominated by long-since-patched software.
What to do
- Security leaders. Check whether Citrix is in your estate and, if so, raise its patch and monitoring priority.
- Lean IT orgs. If you run Citrix, treat its KEV items as front-of-line this cycle.
- MSPs. Flag Citrix across client stacks; a newly-rising exploited vendor is a proactive-outreach reason.
Our take
A vendor climbing the recent exploited list is a leading indicator worth acting on before it is your incident. The timely list is the one whose changes matter.
More records like this: Vendors breaking into the most-exploited list →