CVE-2020-8193: Citrix ADC and Gateway improper access control allows unauthenticated endpoint access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and a public exploit, though CVSS impact is limited to low confidentiality and integrity.

What it is

Citrix ADC, Citrix Gateway, and Citrix SD-WAN WAN-OP contain an improper access control flaw (CWE-284/CWE-287) that lets unauthenticated users reach certain URL endpoints. The issue affects multiple product lines and firmware branches, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it should be treated as actively targeted.

Impact

An unauthenticated attacker gains access to restricted URL endpoints, which can expose limited confidentiality and integrity impact. The CVSS vector shows low confidentiality and integrity impact with no availability impact.

Attack surface

The flaw is reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), meaning an unauthenticated remote request to the affected endpoints is sufficient. No authentication is required per the CVSS vector and description.

Exploitation

CISA added this CVE to the KEV catalog on 2021-11-03, indicating known exploitation in the wild. EPSS is very high (0.88411, 99.763rd percentile), and a public exploit reference exists on Packet Storm.

What to do

• Apply the vendor updates listed in Citrix advisory CTX276688 to move to fixed firmware versions (13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18, and SD-WAN WAN-OP 11.1.1a, 11.0.3d, 10.2.7 or later).
• Restrict management and appliance interfaces from untrusted networks using network ACLs or segmentation.
• Monitor Citrix security advisories and CISA KEV for follow-up guidance and required actions.
• If immediate patching is not possible, reduce exposure by limiting reachable URL endpoints and applying compensating controls at the perimeter.

Detection

• Review web and appliance logs for unauthenticated requests to unusual or restricted URL endpoints on Citrix ADC, Gateway, and SD-WAN WAN-OP systems.
• Hunt for access patterns consistent with the public exploit reference (Packet Storm local file inclusion) against affected appliances.
• Correlate network traffic to Citrix management or gateway interfaces from unexpected sources with known exploitation indicators.
• Track appliance firmware versions against the fixed versions to identify unpatched assets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.