← Vulnerability Intelligence

CVE-2023-3519

Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Unauthenticated remote code execution

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
100% (percentile: 100) as of 2 November 2026
CWE
CWE-94

Affected products

citrix: netscaler application delivery controller; citrix: netscaler gateway

References