CVE-2024-8535: Authenticated user can access unintended user capabilities

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-12 · updated 2026-06-17
Weakness: CWE-552

Description

Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources

Affected products

Citrix NetScaler ADC: from 12.1 before 13.1-55.34; from 14.1 before 14.1-29.72 — fixed in 13.1-55.34, 14.1-29.72
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.321; from 13.1 before 13.1-37.207 — fixed in 12.1-55.321, 13.1-37.207
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.321 — fixed in 12.1-55.321
Citrix NetScaler Gateway: from 12.1 before 13.1-55.34; from 14.1 before 14.1-29.72 — fixed in 13.1-55.34, 14.1-29.72
Netscaler Adc: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1fips before 37.207; from 12.1-fips before 55.321; from 12.1-ndcpp before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321
Netscaler Gateway: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1fips before 37.207; from 12.1-fips before 55.321; from 12.1-ndcpp before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321
Citrix NetScaler ADC: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1 FIPS before 37.207; from 12.1-FIPS before 55.321; from 12.1-NDcPP before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321
Citrix NetScaler Gateway: from 14.1 before 29.72; from 13.1 before 55.34; from 13.1-FIPS before 37.207; from 12.1-FIPS before 55.321; from 12.1-NDcPP before 55.321 — fixed in 29.72, 55.34, 37.207, 55.321

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-55.34, 14.1-29.72; Citrix Netscaler Application Delivery Controller Fips 12.1-55.321, 13.1-37.207; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.321; Citrix NetScaler Gateway 13.1-55.34, 14.1-29.72; Netscaler Adc 29.72, 55.34, 37.207, 55.321; Netscaler Gateway 29.72, 55.34, 37.207, 55.321; Citrix NetScaler ADC 29.72, 55.34, 37.207, 55.321; Citrix NetScaler Gateway 29.72, 55.34, 37.207, 55.321. Check the vendor advisory for mitigations.

References

https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US

Get alerted when CVE-2024-8535 or the next vulnerability affects your stack