CybersecurityCitrix NetScaler Vulnerabilities: What Every Business Needs to Patch Right Now
If your organization runs Citrix NetScaler ADC or NetScaler Gateway — and a significant portion of Seattle-area businesses do — you need to read this carefully. Multiple critical vulnerabilities have been disclosed and are being actively exploited in the wild. Attackers are not waiting for you to patch. Neither should you.
This post covers every significant NetScaler CVE that remains relevant as of late 2026, the specific builds affected, what attackers are doing with each one, and the exact firmware versions that resolve them.
Why NetScaler Vulnerabilities Are High-Value Targets
NetScaler ADC and Gateway sit at the edge of your network. They handle authentication, load balancing, SSL termination, and remote access — often for your entire workforce. A compromised NetScaler appliance gives an attacker a privileged position: they can intercept credentials, pivot into internal systems, and establish persistence before your security team even knows something is wrong.
That is why nation-state actors, ransomware groups, and opportunistic attackers all prioritize NetScaler exploits. The attack surface is enormous, the devices are internet-facing by design, and many organizations are slow to patch appliances they consider "infrastructure."
Critical & High-Severity CVEs — Current Status
CVE-2023-3519 — Unauthenticated Remote Code Execution
CVSS Score: 9.8 (Critical)
This is the one that started a wave of mass exploitation in mid-2023 and continues to be leveraged against unpatched appliances. An unauthenticated attacker can execute arbitrary code as root on a NetScaler appliance configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.
CISA issued an emergency directive. Thousands of organizations were compromised before patches were widely applied. Webshells were implanted on vulnerable devices and have persisted on systems where administrators patched the binary but did not audit for post-exploitation artifacts.
Affected versions:
- NetScaler ADC and Gateway 13.1 before 13.1-49.13
- NetScaler ADC and Gateway 13.0 before 13.0-91.13
- NetScaler ADC 12.1-FIPS before 12.1-55.297
- NetScaler ADC 12.1-NDcPP before 12.1-55.297
Recommended build: 13.1-49.13 or later; 13.0-91.13 or later. If you are still on 12.1, migrate — it reached end of life.
Action required: Patch immediately. If you were running a vulnerable version at any point after July 2023, treat the appliance as potentially compromised and conduct a forensic review before trusting it.
CVE-2023-4966 — Sensitive Information Disclosure ("Citrix Bleed")
CVSS Score: 9.4 (Critical)
Known as "Citrix Bleed," this vulnerability allows an unauthenticated remote attacker to retrieve memory contents from the appliance — including valid session tokens. Attackers can hijack authenticated sessions without needing credentials, bypassing MFA entirely.
Ransomware groups including LockBit 3.0 weaponized this vulnerability extensively. The attack is trivially simple: send a crafted HTTP GET request, receive session tokens in the response, replay them. No credentials. No MFA bypass needed. Just a working session.
Affected versions:
- NetScaler ADC and Gateway 14.1 before 14.1-8.50
- NetScaler ADC and Gateway 13.1 before 13.1-49.15
- NetScaler ADC and Gateway 13.0 before 13.0-92.19
- NetScaler ADC 13.1-FIPS before 13.1-37.163
- NetScaler ADC 12.1-FIPS before 12.1-55.300
- NetScaler ADC 12.1-NDcPP before 12.1-55.300
Recommended build: 14.1-8.50 or later; 13.1-49.15 or later; 13.0-92.19 or later.
Action required: Patch and immediately terminate all active and persistent sessions after applying the update. Patching alone does not invalidate sessions that were already hijacked. Run the following on your appliance after patching:
kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
kill aaa session -all
clear lb persistentSessions
CVE-2023-4967 — Denial of Service
CVSS Score: 8.2 (High)
An unauthenticated attacker can cause a denial of service condition on appliances configured as Gateway or AAA virtual servers. While less dramatic than RCE or session hijacking, a DoS against your NetScaler Gateway takes down remote access for your entire organization.
Affected versions: Same as CVE-2023-4966 above.
Recommended build: Same remediation as CVE-2023-4966 — the same patch resolves both.
CVE-2024-8534 — Memory Safety Vulnerability Leading to RCE
CVSS Score: 9.4 (Critical)
Disclosed in late 2024, this vulnerability affects the NetScaler management interface. An authenticated attacker with low privileges can exploit a memory safety issue to achieve remote code execution with elevated privileges. Combined with credential theft from CVE-2023-4966, this creates a full compromise chain.
Affected versions:
- NetScaler ADC and Gateway 14.1 before 14.1-29.72
- NetScaler ADC and Gateway 13.1 before 13.1-55.34
- NetScaler ADC and Gateway 13.0 before 13.0-92.31
- NetScaler ADC 13.1-FIPS before 13.1-37.207
- NetScaler ADC 12.1-FIPS before 12.1-55.321
Recommended build: 14.1-29.72 or later; 13.1-55.34 or later; 13.0-92.31 or later.
CVE-2024-8535 — Improper Access Control
CVSS Score: 5.8 (Medium)
An authenticated attacker can access resources that should be restricted based on their privilege level. While rated medium, this is frequently chained with higher-severity vulnerabilities to escalate access after initial compromise.
Affected versions: Same as CVE-2024-8534.
Recommended build: Same remediation as CVE-2024-8534.
CVE-2024-12284 — Privilege Escalation via NetScaler Console
CVSS Score: 8.8 (High)
Disclosed in early 2025, this vulnerability affects NetScaler Console (formerly ADM). An authenticated attacker can escalate privileges to gain administrative control of the management plane. If your NetScaler Console is internet-accessible — which it should not be, but often is — this is critical-severity in practice.
Affected versions:
- NetScaler Console 14.1 before 14.1-38.53
- NetScaler Console 13.1 before 13.1-55.34
- NetScaler Console 13.0 before 13.0-93.51
Recommended build: 14.1-38.53 or later; 13.1-55.34 or later; 13.0-93.51 or later.
Additional hardening: Restrict NetScaler Console access to management VLANs only. It should never be reachable from the internet.
CVE-2025-5777 — Authentication Bypass in Gateway Virtual Server
CVSS Score: 9.1 (Critical)
The most recently disclosed critical vulnerability at time of writing. An unauthenticated attacker can bypass authentication on NetScaler Gateway virtual servers under specific nFactor authentication configurations. Exploitation has been observed in targeted attacks against financial services and healthcare organizations.
Affected versions:
- NetScaler ADC and Gateway 14.1 before 14.1-47.46
- NetScaler ADC and Gateway 13.1 before 13.1-58.32
Recommended build: 14.1-47.46 or later; 13.1-58.32 or later.
Action required: If you use nFactor authentication on your Gateway virtual servers, treat this as P1. Patch before end of business.
Recommended Firmware Targets by Release Train
| Release Train | Minimum Recommended Build | Notes |
|---|---|---|
| NetScaler 14.1 | 14.1-47.46 | Current recommended train |
| NetScaler 13.1 | 13.1-58.32 | Supported; migrate to 14.1 when possible |
| NetScaler 13.0 | 13.0-92.31 | Approaching end of life — plan migration |
| NetScaler 12.1 | End of Life | No longer receiving security patches — migrate immediately |
| NetScaler 12.1-FIPS / NDcPP | 12.1-55.321 | FIPS/NDcPP builds only; migrate to 13.1-FIPS |
If you are on any 12.x build, you are running an end-of-life platform with no security patch coverage. Migrate to 13.1 or 14.1 immediately.
Beyond Patching: What Else You Should Do
Patching closes the vulnerability, but it does not undo exploitation that already occurred. If your appliance was running a vulnerable version at any point during the active exploitation windows, you need to do more than apply a firmware update.
1. Audit for webshells and persistence mechanisms. CVE-2023-3519 exploitation frequently resulted in webshells being written to /netscaler/ns_gui/vpn/ and /var/netscaler/logon/LogonPoint/. Check these directories for unexpected files.
2. Review authentication logs for anomalous session activity. Look for sessions that authenticated successfully but originated from unexpected IP ranges, particularly around the dates of public CVE disclosure.
3. Rotate all credentials that traversed the appliance. If session tokens were exposed via CVE-2023-4966, assume any credential that authenticated through the Gateway during the exposure window is compromised. Force password resets and revoke OAuth tokens.
4. Restrict management interface access. The NSIP (NetScaler IP) management interface should never be reachable from the internet. Restrict it to a dedicated management VLAN with MFA-protected jump host access.
5. Enable enhanced logging. Turn on AppFlow and audit logging if not already enabled. You cannot investigate what you did not log.
Not Sure Where Your NetScaler Stands?
If you are not certain which firmware version your appliance is running, whether it was exposed during any of the exploitation windows above, or whether your current configuration follows security best practices — that is exactly the kind of assessment we do.
Our Cybersecurity Audit covers your full network perimeter, including NetScaler and other edge appliances, and delivers a concrete remediation roadmap — not a report full of jargon. If you have NetScaler in your environment, this is not optional maintenance. It is an active threat.
Schedule a Cybersecurity Audit and get your NetScaler environment assessed by a certified expert.
Need expert IT support for your Seattle business?
Novusforge provides managed IT, cybersecurity, and cloud services tailored for small and medium businesses in the Seattle metro area.
