CVE-2023-3519: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-07-19
EPSS: 99.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-19 · updated 2026-08-05
Weakness: CWE-94

Description

Unauthenticated remote code execution

Affected products

Citrix NetScaler ADC: from 13.0 before 13.0-91.13; from 13.1 before 13.1-49.13 — fixed in 13.0-91.13, 13.1-49.13
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.297; from 13.1 before 13.1-37.159 — fixed in 12.1-55.297, 13.1-37.159
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.297 — fixed in 12.1-55.297
Citrix NetScaler Gateway: from 13.0 before 13.0-91.13; from 13.1 before 13.1-49.13 — fixed in 13.0-91.13, 13.1-49.13
Citrix NetScaler ADC: from 13.1 before 49.13; from 13.0 before 91.13; from 13.1-FIPS before 37.159; from 12.1-FIPS before 55.297; from 12.1-NDcPP before 55.297 — fixed in 49.13, 91.13, 37.159, 55.297
Citrix NetScaler Gateway: from 13.1 before 49.13; from 13.0 before 91.13 — fixed in 49.13, 91.13

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-91.13, 13.1-49.13; Citrix Netscaler Application Delivery Controller Fips 12.1-55.297, 13.1-37.159; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.297; Citrix NetScaler Gateway 13.0-91.13, 13.1-49.13; Citrix NetScaler ADC 49.13, 91.13, 37.159, 55.297; Citrix NetScaler Gateway 49.13, 91.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-3519 or the next vulnerability affects your stack