CVE-2023-24487: Arbitrary file read

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-10 · updated 2026-06-17
Weakness: CWE-253

Description

Arbitrary file read in Citrix ADC and Citrix Gateway

Affected products

Citrix Application Delivery Controller: from 12.1 before 12.1-65.35; from 13.0 before 13.0-90.11; from 13.1 before 13.1-45.61 — fixed in 12.1-65.35, 13.0-90.11, 13.1-45.61
Citrix Application Delivery Controller Fips: from 12.1 before 12.1-55.296; from 13.1 before 13.1-37.150 — fixed in 12.1-55.296, 13.1-37.150
Citrix Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.296 — fixed in 12.1-55.296
NetScaler Gateway: from 12.1 before 12.1-65.35; from 13.0 before 13.0-90.11; from 13.1 before 13.1-45.61 — fixed in 12.1-65.35, 13.0-90.11, 13.1-45.61
Citrix ADC and Citrix Gateway: from 13.1 before 13.1-45.61; from 13.0 before 13.0-90.11; from 12.1 before 12.1-65.35; from 12.1-FIPS before 12.1-55.296; from 13.1-FIPS before 13.1-37.150; from 12.1-NDcPP before 12.1-55.296 — fixed in 13.1-45.61, 13.0-90.11, 12.1-65.35, 12.1-55.296, 13.1-37.150

How to fix

Upgrade to a fixed version: Citrix Application Delivery Controller 12.1-65.35, 13.0-90.11, 13.1-45.61; Citrix Application Delivery Controller Fips 12.1-55.296, 13.1-37.150; Citrix Application Delivery Controller Ndcpp 12.1-55.296; NetScaler Gateway 12.1-65.35, 13.0-90.11, 13.1-45.61; Citrix ADC and Citrix Gateway 13.1-45.61, 13.0-90.11, 12.1-65.35, 12.1-55.296. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24487 or the next vulnerability affects your stack