CVE-2023-6548
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 3% (percentile: 88) as of 2 November 2026
- CWE
- CWE-94
Affected products
citrix: netscaler application delivery controller; citrix: netscaler gateway