Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Citrix NetScaler ADC Unauthenticated Remote Code Execution

Memory corruption stack buffer overflow in Citrix NetScaler Gateway SAML authentication endpoint allowing unauthenticated remote code execution.

Status
Vendor Patched
Reported / Disclosed
2023

Impact

  • Stack-based buffer overflow triggered via crafted Host header in unauthenticated HTTP requests.
  • Arbitrary shellcode execution in root context on perimeter gateway appliances.
  • Immediate exfiltration of Active Directory authentication tokens and TLS private keys.

Timeline

  1. JULY 18, 2023

    Citrix published security bulletin CTX561482 warning of wild exploitation.

  2. JULY 2023

    Security operations teams deployed mass perimeter patching and memory integrity checks.

aura~
Back to CVEs & Disclosures