CVE-2020-8197

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-10 · updated 2026-06-17

Description

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands.

Affected products

Citrix Application Delivery Controller Firmware: from 10.5 before 10.5-70.18; from 11.1 before 11.1-64.14; from 12.0 before 12.0-63.21; from 12.1 before 12.1-57.18; from 13.0 before 13.0-58.30 — fixed in 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18, 13.0-58.30
Citrix Gateway Firmware: from 13.0 before 13.0-58.30 — fixed in 13.0-58.30
Citrix Netscaler Gateway Firmware: from 10.5 before 10.5-70.18; from 11.1 before 11.1-64.14; from 12.0 before 12.0-63.21; from 12.1 before 12.1-57.18 — fixed in 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18
Citrix ADC, Citrix Gateway: 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller Firmware 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18; Citrix Gateway Firmware 13.0-58.30; Citrix Netscaler Gateway Firmware 10.5-70.18, 11.1-64.14, 12.0-63.21, 12.1-57.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8197 or the next vulnerability affects your stack