What’s Vulnerable › Vulnerabilities

CVE-2023-3467

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-19 · updated 2026-06-17
• Weakness: CWE-269

Description

Privilege Escalation to root administrator (nsroot)

Affected products

• Citrix NetScaler ADC: from 13.0 before 13.0-91.13; from 13.1 before 13.1-49.13 — fixed in 13.0-91.13, 13.1-49.13
• Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.297; from 13.1 before 13.1-37.159; 11.1-65.22 (and their updates) — fixed in 12.1-55.297, 13.1-37.159
• Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.297 — fixed in 12.1-55.297
• Citrix NetScaler Gateway: from 13.0 before 13.0-91.13; from 13.1 before 13.1-49.13 — fixed in 13.0-91.13, 13.1-49.13
• Citrix NetScaler ADC: from 13.1 before 49.13; from 13.0 before 91.13; from 13.1-FIPS before 37.159; from 12.1-FIPS before 55.297; from 12.1-NDcPP before 55.297 — fixed in 49.13, 91.13, 37.159, 55.297
• Citrix NetScaler Gateway: from 13.1 before 49.13; from 13.0 before 91.13 — fixed in 49.13, 91.13

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-91.13, 13.1-49.13; Citrix Netscaler Application Delivery Controller Fips 12.1-55.297, 13.1-37.159; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.297; Citrix NetScaler Gateway 13.0-91.13, 13.1-49.13; Citrix NetScaler ADC 49.13, 91.13, 37.159, 55.297; Citrix NetScaler Gateway 49.13, 91.13. Check the vendor advisory for mitigations.

References

• https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
• https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467

Get alerted when CVE-2023-3467 or the next vulnerability affects your stack