What’s Vulnerable › Vulnerabilities

CVE-2021-22920

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-05 · updated 2026-06-17
• Weakness: CWE-284

Description

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session.

Affected products

• Citrix Application Delivery Management (Citrix ADM): 12.1-62.25, 13.0-82.42 (and their updates)
• NetScaler Gateway: 12.1-62.25, 13.0-82.42 (and their updates)
• Citrix ADC, Citrix Gateway: Citrix ADC and Citrix Gateway 13.0-82.45 and later releases of 13.0, Citrix ADC and Citrix Gateway 12.1-62.27 and later releases of 12.1

References

• https://support.citrix.com/article/CTX319135
• https://support.citrix.com/article/CTX319135

Get alerted when CVE-2021-22920 or the next vulnerability affects your stack