CVE-2020-8195: Citrix ADC and Gateway improper input validation information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a public exploit and high EPSS, though CVSS is medium and impact is limited to information disclosure.

What it is

Citrix ADC, Citrix Gateway, and Citrix SD-WAN WAN-OP contain improper input validation that can result in limited information disclosure to low privileged users. The flaw is tracked as CWE-20 and CWE-22, indicating a path traversal component that may allow reading files outside intended boundaries. It matters because the affected appliances are commonly internet-facing and the issue is listed in CISA KEV.

Impact

An attacker with low privileges can obtain limited sensitive information from the appliance. The CVSS vector shows high confidentiality impact with no integrity or availability impact.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). No authentication bypass is implied; the attacker needs a low-privileged account or session.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-11-03, and a public exploit reference exists on Packet Storm. EPSS is 0.33029 (98.3rd percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor updates listed in Citrix advisory CTX276688 to the fixed versions for ADC, Gateway, and SD-WAN WAN-OP.
• Restrict management and low-privileged access to Citrix ADC, Gateway, and SD-WAN WAN-OP interfaces to trusted networks.
• Review and minimize low-privileged accounts on affected appliances.
• Monitor for path traversal patterns in requests to affected appliances and block suspicious input at the edge.
• Verify remediation against CISA KEV required action and track completion.

Detection

• Search web and appliance logs for path traversal sequences (../, encoded variants) in requests to Citrix ADC, Gateway, or SD-WAN WAN-OP endpoints.
• Alert on file read or download activity by low-privileged users outside normal administrative workflows.
• Correlate outbound or internal access to sensitive files from appliance processes with unusual request patterns.
• Monitor for known exploit signatures associated with the Packet Storm local file inclusion reference.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.