CVE-2023-6548

8.8 highKEVEPSS 3.2%

Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-01-17, due 2024-01-24
CWE: CWE-94
Published: 2024-01-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

citrix:netscaler_application_delivery_controller
citrix:netscaler_gateway

References

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-6548

Check your stack JSON