CVE-2020-8196: Citrix ADC and Gateway improper access control information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS is only medium (4.3) and impact is limited to information disclosure, but the CVE is in CISA KEV with known exploitation and a high EPSS percentile, so it warrants prompt patching.

What it is

Citrix ADC, Citrix Gateway and Citrix SD-WAN WAN-OP appliances contain an improper access control flaw (CWE-284/CWE-287) that allows limited information disclosure to low privileged users. It matters because the affected appliances are internet-facing and the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it has been used in real attacks despite a modest CVSS score.

Impact

An authenticated low-privileged user can read information they should not have access to; the scope is limited to confidentiality with no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network (AV:N) with low attack complexity and no user interaction; it requires the attacker to hold low privileges (PR:L), meaning a valid low-privileged account on the appliance or gateway.

Exploitation

CVE-2020-8196 is listed in CISA KEV with a due date of 2022-05-03, indicating known exploitation in the wild; EPSS gives a 30-day probability of 0.26333 (97.9th percentile), and a third-party reference describes local file inclusion.

What to do

• Apply the vendor updates listed in Citrix advisory CTX276688 to move to fixed versions (13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14, 10.5-70.18 or later for ADC/Gateway, and 11.1.1a, 11.0.3d, 10.2.7 or later for SD-WAN WAN-OP).
• Restrict management and appliance access to trusted networks and remove or disable unnecessary low-privileged accounts.
• Review and tighten access control configuration on ADC, Gateway and SD-WAN WAN-OP appliances.
• Monitor vendor advisories and CISA KEV guidance for follow-up actions on this CVE.

Detection

• Audit appliance logs for access to files or endpoints by low-privileged accounts that fall outside their normal role.
• Alert on local file inclusion patterns (path traversal or file path parameters) in requests to Citrix ADC/Gateway management interfaces.
• Correlate authentication events for low-privileged users with subsequent unusual read activity on the appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.