CVE-2023-6549: Citrix NetScaler ADC and Gateway out-of-bounds memory read and DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw is unauthenticated, network-reachable, causes availability impact, and is listed in CISA KEV with high EPSS, though it is rated 7.5 HIGH rather than critical.

What it is

NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer (CWE-119), allowing an out-of-bounds memory read and denial of service. The flaw is remotely reachable without authentication, and Citrix has issued a vendor advisory covering this CVE alongside CVE-2023-6548. Because these appliances commonly sit at the network edge, unauthenticated availability impact is significant.

Impact

An unauthenticated attacker can trigger an out-of-bounds memory read and cause a denial of service, disrupting availability of the NetScaler appliance and any services it fronts. The record does not state whether the memory read can be leveraged for information disclosure beyond the DoS.

Attack surface

Reached over the network via the CVSS vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. The description does not specify which interface or endpoint is targeted, so the exact reachable path is not detailed in this record.

Exploitation

CVE-2023-6549 is listed in CISA KEV with a due date of 2024-02-07, indicating known exploitation in the wild, and EPSS shows a 30-day probability of 0.57633 (99th percentile). No ransomware campaign use is recorded.

What to do

• Apply the vendor patch per the Citrix security bulletin CTX584986 for CVE-2023-6548 and CVE-2023-6549.
• If patching is not immediately possible, apply the mitigations in the vendor instructions or discontinue use of the affected appliance as directed by CISA KEV.
• Restrict management and service exposure of NetScaler ADC and Gateway to trusted networks where feasible.
• Monitor vendor advisories for updated guidance, since the bulletin covers two CVEs.
• Verify patch level on all NetScaler ADC and Gateway instances, including HA pairs and disaster recovery nodes.

Detection

• Monitor NetScaler appliance logs and system events for unexpected crashes, restarts or service interruptions.
• Watch for anomalous or malformed traffic patterns toward NetScaler ADC and Gateway endpoints that precede availability loss.
• Alert on NetScaler process restarts or failover events that correlate with external connection bursts.
• Track CISA KEV status and vendor bulletin updates to confirm exposure and remediation state.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.