CVE-2023-3519: Citrix NetScaler unauthenticated remote code execution
The short version: NetScaler ADC and NetScaler Gateway (Citrix's access appliances) have an unauthenticated remote code execution flaw (CVE-2023-3519). When the device is configured as a Gateway or AAA virtual server, an attacker with no credentials can run code on it. It scores 9.8, it was exploited as a zero-day with web shells dropped on compromised appliances, and it's in CISA's KEV catalog with ransomware-campaign use. Patching isn't enough on its own — you also have to check whether you were already hit. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Citrix, CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.4% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-08-09 |
| Known exploited? | Yes — exploited as a zero-day; associated with ransomware activity |
| Vulnerability type | CWE-94 code injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication (device must be configured as a Gateway or AAA virtual server) |
| Affected | NetScaler ADC & Gateway configured as a Gateway/AAA vServer: 13.1 < 13.1-49.13, 13.0 < 13.0-91.13, 13.1-FIPS < 13.1-37.159, 12.1-FIPS/NDcPP < 12.1-55.297 (12.1 and 13.0 are EOL — upgrade) |
| Fixed in | 13.1-49.13 · 13.0-91.13 · and the matching FIPS/NDcPP builds (14.1 and later are not affected) |
What you need to know
NetScaler ADC/Gateway sits at the edge, terminating VPN and application-access traffic. CVE-2023-3519 is a code-injection flaw reachable before authentication, provided the appliance is configured as a Gateway (VPN vServer, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server — the very configurations that are meant to face the internet.
That combination is why this became a headline event:
- It's the access appliance itself. Code execution on the box that fronts remote access means the attacker is inside the thing that guards the door.
- It's pre-authentication and internet-reachable by design. No credential, no chain.
- It was live before the fix. Attackers exploited it as a zero-day and dropped web shells for persistence; CISA and Citrix documented in-the-wild compromise, so an affected appliance may have been touched before you patched.
How serious we see it
Critical — the 9.8 is not hyperbole here.
Unauthenticated, network-reachable code execution on a perimeter access appliance, confirmed exploited in the wild and linked to ransomware operators, is the definition of top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it only affects specific builds in the Gateway/AAA configuration, the fixes are published, and exposure is quick to determine. The catch is the zero-day window — being patched and being clean are separate questions, so hunt as well as patch.
Recommendations
Straight from Citrix's bulletin (CTX561482) and CISA:
- Patch now. Upgrade to 13.1-49.13 / 13.0-91.13 (or the matching FIPS/NDcPP builds) or a supported 14.x release. NetScaler 12.1 and 13.0 are End-of-Life — migrate off them.
- Hunt for prior compromise. Follow Citrix's and CISA's guidance to look for web shells and unexpected files, and review appliance logs — patching does not remove an implant left before you upgraded.
- If you find evidence of compromise, respond fully. Rebuild the appliance and rotate all credentials, keys, and certificates it handled; investigate for lateral movement.
- Harden exposure. Restrict management interfaces, and limit internet reachability to what the Gateway genuinely needs.
- Confirm your exposure first. Verify whether you run an affected build configured as a Gateway/AAA vServer.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing NetScaler Gateway interfaces, fingerprints the build, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because our severity take reflects the real-world impact.
That outside-in, continuous view is the whole point: when a NetScaler zero-day breaks, the exposed appliance is already mapped, so you can go straight to patch-and-verify instead of starting with "what do we even run?"