CVE-2011-2882: Citrix Access Gateway ActiveX control stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with complete confidentiality, integrity and availability impact and a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx shipped with Citrix Access Gateway Enterprise Edition contains a stack-based buffer overflow (CWE-119). Crafted HTTP header data overflows a fixed buffer, letting a remote attacker run arbitrary code in the context of the process hosting the control.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the affected process, typically the user's browser session. That can lead to full compromise of the client host.

Attack surface

The flaw is reachable over the network (AV:N) through the ActiveX control, which is instantiated in a browser; the CVSS vector shows no authentication required (Au:N) but medium attack complexity (AC:M), consistent with needing to lure a user to load the control. User interaction is implied by the ActiveX delivery model even though the vector does not encode it.

Exploitation

Not listed in CISA KEV and no reference tags indicate a public exploit, but EPSS is high at 0.564 (99th percentile), suggesting elevated likelihood of exploitation activity. No exploit code or in-the-wild reports are stated in the record.

What to do

• Upgrade Citrix Access Gateway Enterprise Edition to 8.1-67.7, 9.0-70.5, or 9.1-96.4 (or later) as applicable.
• Disable or remove the NSEPA.NsepaCtrl.1 ActiveX control and block its CLSID via browser/domain policy.
• Restrict access to the Access Gateway management interface and require VPN/authentication before reaching it.
• Apply kill bits or equivalent controls for legacy ActiveX components on endpoints that no longer need them.

Detection

• Monitor for nsepa.ocx being loaded by browser processes and for crashes in that module.
• Alert on HTTP requests to Access Gateway endpoints with unusually long or malformed header values.
• Hunt for suspicious child processes spawned by browser processes on hosts with the ActiveX control installed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.