Citrix Netscaler Gateway

Citrix NetScaler ADC/Gateway Mem Overflow in Virtual Servers – DoS
CVE-2025-6543 - June 25, 2025

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Buffer Overflow

NetScaler ADC/Gateway: Improper Access Control on Management Interface
CVE-2025-5349 8.8 - High - June 17, 2025

Improper access control on the NetScaler Management Interface in NetScaler ADC?and NetScaler Gateway

Memory Overread in Citrix NetScaler Gateway
CVE-2025-5777 - June 17, 2025

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Out-of-bounds Read

Citrix NetScaler ADC/Gateway RDP-induced memory corruption DoS
CVE-2024-8534 8.1 - High - November 12, 2024

Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled

Memory Corruption

CVE-2024-8535: NetScaler ADC/Gateway Unauthorized Capability Escalation via KCDAccount Kerberos SSO
CVE-2024-8535 8.1 - High - November 12, 2024

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources

CVE-2024-5491 DoS in Citrix NetScaler ADC/Gateway
CVE-2024-5491 7.5 - High - July 10, 2024

Denial of Service in NetScaler ADC and NetScaler Gateway in NetScaler

Open Redirect in NetScaler ADC & Gateway Allows Arbitrary URL Redirection
CVE-2024-5492 6.1 - Medium - July 10, 2024

Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites in NetScaler ADC and NetScaler Gateway

Citrix NetScaler ADC/Gateway OOB Buffer Read DoS
CVE-2023-6549 8.2 - High - January 17, 2024

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

Buffer Overflow

NetScaler ADC/Gateway Code Injection RCE via Management Interface
CVE-2023-6548 5.5 - Medium - January 17, 2024

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Code Injection

DoS in Citrix NetScaler ADC & Gateway when Gateway Configured
CVE-2023-4967 7.5 - High - October 27, 2023

Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server

Buffer Overflow

Citrix NetScaler ADC/Gateway Sensitive Info Disclosure
CVE-2023-4966 9.4 - Critical - October 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtualserver.

Buffer Overflow

Unknown: Reflected XSS Vulnerability (CVE-2023-3466)
CVE-2023-3466 6.1 - Medium - July 19, 2023

Reflected Cross-Site Scripting (XSS)

XSS

Privilege Escalation to root via nsroot (CVE20233467)
CVE-2023-3467 8 - High - July 19, 2023

Privilege Escalation to root administrator (nsroot)

CVE-2023-3519: Unauth RCE in Unknown Product
CVE-2023-3519 9.8 - Critical - July 19, 2023

Unauthenticated remote code execution

Code Injection

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider
CVE-2021-22927 8.1 - High - August 05, 2021

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session.

Session Fixation

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)
CVE-2021-22919 7.5 - High - August 05, 2021

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.

Allocation of Resources Without Limits or Throttling

Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers
CVE-2020-8299 - June 16, 2021

Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance.

Resource Exhaustion

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control
CVE-2020-8300 - June 16, 2021

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

Authorization

Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition 9.3.0
CVE-2018-5314 7.5 - High - March 01, 2018

Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build 55.13, and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition 9.3.0 allows remote attackers to execute a system command or read arbitrary files via an SSH login prompt.

authentification