CVE-2023-3519: Citrix NetScaler ADC and Gateway unauthenticated code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, KEV listing, ransomware use flag and near-certain EPSS probability.

What it is

Citrix NetScaler ADC and NetScaler Gateway contain a code injection flaw (CWE-94) that allows unauthenticated remote code execution. The vendor bulletin covers this CVE alongside CVE-2023-3466 and CVE-2023-3467, and the record does not specify affected versions. Because the flaw is remotely reachable without credentials and has been exploited in the wild, it is a top-tier risk for any internet-facing deployment.

Impact

An attacker can execute arbitrary code on the appliance, gaining full control of the device with high confidentiality, integrity and availability impact. Compromise of a NetScaler can expose session traffic and provide a foothold into the internal network.

Attack surface

Reachable over the network via the appliance's web-facing interface, per the CVSS vector AV:N/PR:N/UI:N. No authentication or user interaction is required, so any exposed NetScaler ADC or Gateway instance is a candidate target.

Exploitation

Listed in CISA KEV since 2023-07-19 with a 2023-08-09 remediation due date and flagged for known ransomware campaign use; EPSS 30-day probability is 0.99749 (99.95th percentile). A public exploit reference exists (Packet Storm), confirming active exploitation.

What to do

• Apply the Citrix security bulletin CTX561482 updates for NetScaler ADC and NetScaler Gateway immediately.
• If patching cannot be done at once, follow the vendor's mitigation guidance or take the appliance off the internet until it is fixed.
• Restrict management and user-facing access to trusted networks and IP ranges where operationally possible.
• Rotate credentials and inspect the appliance for signs of tampering after patching, since code execution may have already occurred.
• Track the CISA KEV due date (2023-08-09) to confirm remediation is completed on schedule.

Detection

• Review NetScaler and web server logs for unexpected POST requests or anomalous URI patterns preceding code execution.
• Monitor for new or modified files, unexpected processes, and outbound connections from the appliance.
• Alert on authentication or configuration changes made outside normal maintenance windows.
• Use the vendor bulletin and CISA KEV entry to build asset checks confirming all NetScaler ADC and Gateway instances are on a fixed build.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.