CVE-2023-24488: Citrix ADC and Gateway cross-site scripting flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityInternet-facing appliance with a very high EPSS score and scope-changing XSS, though exploitation requires user interaction and no KEV listing exists.

What it is

CVE-2023-24488 is a reflected cross-site scripting (CWE-79) vulnerability in Citrix ADC and Citrix Gateway. The record gives only a one-line description and no affected version list, so the exact vulnerable builds must be confirmed from the vendor bulletin. It matters because the appliance is an internet-facing access and load-balancing component, and script execution in a victim's browser can expose session data.

Impact

An attacker can run script in the context of a victim's browser session on the Citrix appliance, potentially stealing session cookies or performing actions as the victim. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network (AV:N) with no privileges required (PR:N), but exploitation requires the victim to trigger the crafted request (UI:R), consistent with a reflected XSS delivered via a link or crafted page. No authentication is needed to reach the vulnerable endpoint per the vector.

Exploitation

Not listed in CISA KEV and no ransomware use is documented; EPSS is very high (0.809, 99.6th percentile), suggesting elevated likelihood of attempted exploitation, though the record contains no public exploit reference beyond the vendor advisory.

What to do

• Apply the Citrix security bulletin CTX477714 updates for ADC and Gateway as the first action.
• If immediate patching is not possible, restrict management and user-facing access to trusted networks and review Citrix guidance for workarounds.
• Deploy or tune WAF/IPS rules to block reflected XSS payloads targeting the appliance.
• Set session cookies with HttpOnly and Secure attributes and shorten session lifetimes to limit theft impact.
• Confirm which ADC/Gateway builds are in use against the vendor bulletin, since the record does not list affected versions.

Detection

• Monitor web and ADC logs for requests containing script tags or encoded script payloads in parameters and reflected responses.
• Alert on unusual outbound or referrer patterns from clients that recently hit the appliance, indicating possible script callback.
• Review authentication and session events for anomalous activity following suspicious requests to the appliance.
• Hunt proxy and WAF logs for repeated probing of the same endpoint with varying payload encodings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.