CVE-2023-6549: Citrix NetScaler unauthenticated denial of service and memory over-read
The short version: CVE-2023-6549 is a memory-buffer flaw in NetScaler ADC and Gateway that, when the device is configured as a Gateway or AAA virtual server, lets an unauthenticated attacker trigger a denial of service (and an out-of-bounds memory read). It won't hand over the box, but it can knock your remote-access gateway offline, and it's in CISA's KEV catalog. Patch it. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — unauthenticated availability hit on a perimeter appliance |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS (Citrix, CNA) | 8.2 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
| EPSS | ~57.6% · 99.0th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-02-07 |
| Known exploited? | Yes — KEV-listed |
| Vulnerability type | CWE-119 improper restriction of operations within a memory buffer → unauthenticated denial of service / out-of-bounds read |
| Requires authenticated session? | No — pre-authentication (device must be configured as a Gateway or AAA virtual server) |
| Affected | NetScaler ADC & Gateway configured as a Gateway/AAA vServer: 14.1 < 14.1-12.35, 13.1 < 13.1-51.15, 13.0 < 13.0-92.21, 13.1-FIPS < 13.1-37.176, 12.1-FIPS/NDcPP < 12.1-55.302 (12.1 and 13.0 are EOL) |
| Fixed in | 14.1-12.35 · 13.1-51.15 · 13.0-92.21 · and the matching FIPS/NDcPP builds |
What you need to know
NetScaler ADC/Gateway terminates VPN and application-access traffic at the edge. CVE-2023-6549 is a memory-buffer flaw that an unauthenticated attacker can trigger when the appliance is configured as a Gateway (VPN vServer, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server — the internet-facing roles.
What it does, and what it doesn't:
- It's primarily an availability bug. The reliable outcome is a denial of service — crashing or disrupting the gateway that your remote workforce depends on.
- It also allows an out-of-bounds memory read, which is why it's not purely "availability" — but this is not a code-execution or full-takeover flaw.
- It's unauthenticated and internet-reachable, which is what earns it a place in KEV alongside the authenticated code-injection flaw disclosed with it (CVE-2023-6548).
How serious we see it
Moderate — unauthenticated, network-reachable, and able to take a perimeter access appliance offline, confirmed exploited enough to make KEV. We don't call it Critical, because it doesn't yield code execution or data control — the dominant impact is availability. But losing your remote-access gateway is a real operational hit, and "unauthenticated + internet-facing + KEV" is a prompt-fix profile. The reassuring part: specific builds, published fixes, and the vulnerable configuration is easy to confirm.
Recommendations
Straight from Citrix's bulletin (CTX584986) and CISA:
- Patch now. Upgrade to 14.1-12.35 / 13.1-51.15 / 13.0-92.21 (or the matching FIPS/NDcPP builds). NetScaler 12.1 and 13.0 are End-of-Life — migrate off them.
- Confirm your exposure first. Verify whether you run an affected build configured as a Gateway/AAA vServer.
- Plan for availability. Ensure you can fail over or restore the gateway quickly if it's disrupted.
- Harden exposure. Keep management interfaces private; limit internet reachability to what the Gateway needs.
- Monitor. Watch for unexpected gateway restarts or instability that could indicate probing.
How BreachRisk sees it
BreachRisk starts from the outside in. From little more than your domain it discovers internet-facing NetScaler Gateway interfaces, fingerprints the build, and flags exposure tied to KEV-listed vulnerabilities like this one, surfaced near the top of your results because it's in KEV.
That continuous, attacker's-eye view means the exposed appliance is already mapped — so when a NetScaler availability bug is being exploited, you can go straight to patch-and-confirm rather than starting from an inventory.