Loading story…
Citrix ADC and Citrix Gateway are affected by CVE-2023-24488, an input-sanitization flaw in which URL query parameters are insufficiently sanitized before being placed in an HTTP Location header. An attacker can craft a malicious URL that redirects a user to an attacker-controlled site or uses newline characters to terminate the header and inject a cross-site-scripting payload into the response body.
The issue affects designated releases in the 13.1, 13.0, and 12.1 branches, including 12.1-FIPS and 12.1-NDcPP editions. Organizations using affected Citrix Gateway or ADC appliances should identify exposed versions and upgrade to Citrix’s current fixed release to prevent phishing, redirection, and client-side script-injection attacks.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed that Citrix Gateway's unauthenticated `/oauth/idp/logout` endpoint accepts a `post_logout_redirect_uri` value that can produce open redirects and CRLF-injection reflected XSS, even when OAuth is not configured. They estimated roughly 50,000 Internet-accessible instances and found more than half of 100 scanned systems were unpatched.
Citrix ADC and Citrix Gateway were documented as vulnerable to inadequate sanitization of URL query parameters inserted into HTTP Location headers (CVE-2023-24488). Crafted links could redirect users to attacker-controlled sites or use header injection to deliver XSS payloads; Citrix identified fixed versions and recommended upgrading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourceblog.assetnote.io
Open sourcesupport.citrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix disclosed **CVE-2025-6543**, a critical memory overflow vulnerability in **NetScaler ADC** and **NetScaler Gateway** that affects devices configured as a **Gateway** or **AAA virtual server**. The flaw can trigger unintended control-flow redirection and service disruption, leading to **denial of service**, and was assigned a **CVSS v4.0 score of 9.2**. Affected releases include NetScaler ADC and Gateway `14.1` before `14.1-47.46`, `13.1` before `13.1-59.19`, and NetScaler ADC `13.1-FIPS/NDcPP` before `13.1-37.236-FIPS/NDcPP`; Citrix also said **Secure Private Access** on-prem and hybrid deployments using NetScaler instances are impacted. Citrix directed customers to upgrade immediately to fixed builds or discontinue use where no supported update is available, with the issue tracked in Citrix advisory **CTX694826** and the CVE record **CVE-2025-6543**. Follow-on guidance warned that upgrading to `14.1-47.46` or `13.1-59.19` may introduce authentication problems, including broken login pages in environments using **DUO** or **SAML**, and the company published remediation steps for affected deployments.
Jul 24, 2026
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026