← Vulnerability feed

Vulnerability record · CVE-2009-2213 · published 25 June 2009

CVE-2009-2213: Citrix netscaler access gateway firmware incorrect authorization vulnerability

Citrix · Netscaler Access Gateway Firmware

The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.

6.5 CVSS 3.1 Medium EPSS 2.0% · top 19.8% CWE-863 · Incorrect authorization
6.5CVSS 3.1 base score, v2 6.3
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
16 Jun 2026Last modified by NVD

Description

The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://support.citrix.com/article/CTX118770 Broken LinkVendor Advisory
http://www.securityfocus.com/bid/35422 Broken LinkThird Party AdvisoryVDB Entry
http://www.vupen.com/english/advisories/2009/1641 Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/51274 Third Party AdvisoryVDB Entry
http://support.citrix.com/article/CTX118770 Broken LinkVendor Advisory
http://www.securityfocus.com/bid/35422 Broken LinkThird Party AdvisoryVDB Entry
http://www.vupen.com/english/advisories/2009/1641 Permissions Required
https://exchange.xforce.ibmcloud.com/vulnerabilities/51274 Third Party AdvisoryVDB Entry

Track CVE-2009-2213 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2014-2881Citrix netscaler access gateway firmware vulnerabilityUnspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Application Delive…EPSS 1.9%10.0CVE-2014-2882Citrix netscaler access gateway firmware vulnerabilityUnspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-66.5 and 1…EPSS 1.1%5.4CVE-2013-2767Citrix netscaler access gateway firmware vulnerabilityUnspecified vulnerability in Citrix NetScaler Access Gateway Enterprise Edition (AGEE) before 9.3.62.4 and 10.x through 10.0.74.4, and NetScaler AGEE…EPSS 1.5%5.0CVE-2014-4347Citrix netscaler access gateway firmware information exposure vulnerabilityCitrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway (formerly Access Gateway Enterprise Edition) before 9.3-62.4 and 10.x be…EPSS 1.7%4.3CVE-2014-4346Citrix netscaler application delivery controller firmware cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in administration user interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gat…EPSS 1.7%4.3CVE-2014-1899Citrix netscaler access gateway firmware cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Citrix NetScaler Gateway (formerly Citrix Access Gateway Enterprise Edition) 9.x before 9.3.66.5 and 10.x…EPSS 1.2%9.1CVE-2026-71362Adobe commerce incorrect authorization vulnerabilityAdobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vul…KEVEPSS 88%8.8CVE-2026-42016JFrog Artifactory token scope bypass enables privilege escalationJFrog Artifactory (Self Hosted) before 7.133.11 validates a token's signature and issuer but not its scope, so a token can be used for actions beyond…KEVEPSS 8.6%analysed

Source: NIST National Vulnerability Database (record CVE-2009-2213), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.