CVE-2024-6236: Denial of Service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-10 · updated 2026-06-17
Weakness: CWE-119

Description

Denial of Service in NetScaler Console (formerly NetScaler ADM), NetScaler Agent, and NetScaler SDX

Affected products

Citrix Netscaler Agent: from 13.0-58.30 before 13.0-92.31; from 13.1-4.43 before 13.1-53.22; from 14.1-4.42 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.22, 14.1-25.53
NetScaler Console: from 13.0-58.30 before 13.0-92.31; from 13.1-4.43 before 13.1-53.22; from 14.1-4.42 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.22, 14.1-25.53
Citrix Netscaler Sdx: from 13.0-91.12 before 13.0-92.31; from 13.1-49.13 before 13.1-53.17; from 14.1-4.42 before 14.1-25.53 — fixed in 13.0-92.31, 13.1-53.17, 14.1-25.53
Netscaler Agent: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31
Netscaler Console: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31
Netscaler Sdx: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31
NetScaler Agent: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31
NetScaler SDX: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31
NetSclaer NetScaler Console: from 14.1 before 25.53; from 13.1 before 52.25; from 13.0 before 92.31 — fixed in 25.53, 52.25, 92.31

How to fix

Upgrade to a fixed version: Citrix Netscaler Agent 13.0-92.31, 13.1-53.22, 14.1-25.53; NetScaler Console 13.0-92.31, 13.1-53.22, 14.1-25.53; Citrix Netscaler Sdx 13.0-92.31, 13.1-53.17, 14.1-25.53; Netscaler Agent 25.53, 52.25, 92.31; Netscaler Console 25.53, 52.25, 92.31; Netscaler Sdx 25.53, 52.25, 92.31; NetScaler Agent 25.53, 52.25, 92.31; NetScaler SDX 25.53, 52.25, 92.31; NetSclaer NetScaler Console 25.53, 52.25, 92.31. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-6236 or the next vulnerability affects your stack