What is the CVSS score of CVE-2023-3519?

CVE-2023-3519 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.8%.

Is there a public PoC exploit available for CVE-2023-3519?

Yes, a public proof-of-concept exploit is available for CVE-2023-3519. Prioritise patching immediately. EPSS: 93.8%.

How to fix or mitigate CVE-2023-3519?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

Netscaler Application Delivery Controller CVE-2023-3519

CRITICAL

Code Injection (CWE-94)

2023-07-19 secure@citrix.com

RCE Code Injection Citrix Netscaler Application Delivery Controller Netscaler Gateway

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A03:2021 - Injection ASVS 5.0 V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Critical risk (CVSS 9.8, EPSS 93.8%). Mass exploitation resulted in web shell deployment on thousands of NetScaler appliances. Ransomware groups including LockBit used compromised appliances for initial access to enterprise networks.
Exploit ScenarioDerived	Attackers exploit the RCE to gain code execution on the NetScaler appliance, deploy persistent web shells, and use the appliance's network position at the DMZ boundary to access internal network resources. Credentials transiting the ADC are intercepted for lateral movement.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 93.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in summer 2023, with thousands of appliances compromised before patches were applied.

Earlier versions of this analysis (1)

v1 Mar 26, 2026 - 11:19 CVSS 9.8

A critical unauthenticated RCE in Citrix NetScaler ADC and Gateway (CWE-94 code injection) was exploited at scale in July-August 2023. An estimated 31,000 instances were vulnerable at disclosure.

RemediationAI

Apply Citrix patches. Assume compromise if running vulnerable versions during the exploitation window. Check for web shells, modified configurations, and unauthorized accounts. Rotate all credentials that transited the appliance.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The code injection vulnerability allows unauthenticated attackers to execute arbitrary code on NetScaler appliances through crafted requests. The flaw exists in the NSPPE (NetScaler Perl Processing Engine) and can be exploited remotely without credentials.

Know when Netscaler Application Delivery Controller gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Oct 24, 2025 - 13:42 cisa

CISA KEV

EUVD Exploitation Confirmed

Oct 24, 2025 - 13:42 euvd

EUVD KEV

PoC Detected

Oct 24, 2025 - 13:42 vuln.today

Public exploit code

CVE Published

Jul 19, 2023 - 18:15 nvd

CRITICAL 9.8

DescriptionNVD

Unauthenticated remote code execution

Executive ViewAI

Why It Matters

CVE-2023-3519 presents critical security risk, a code injection vulnerability rated CVSS 9.8. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.

Threat Intelligence Overview

Threat Score

9.8/10

Composite threat intelligence

EPSS Score

93.8%

Top 0% exploitable

EUVD KEV

Listed

EU Exploited Vulnerability

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

Citrix

NVD

CVE.org

CISA KEV

EPSS POC (2) THREAT CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 93.8%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

238

Low Medium High Critical

KEV: +50

EPSS: +94

CVSS: +49

PoC: +20

Weaponized: +15

Threat intel: +10

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)NVD

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*

cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*

cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*

More in Netscaler Application Delivery Controller

View all

CVE-2023-4966 HIGH Act Now POC

7.5 Oct 10

Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows

CVE-2025-5777 CRITICAL Act Now POC

9.3 Jun 17

Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un

CVE-2026-19490 CRITICAL Emergency POC

9.3 Aug 19

Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.

CVE-2025-6543 CRITICAL Emergency POC

9.8 Jun 25

Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended

CVE-2026-8452 HIGH Act Now POC

8.8 Jun 30

Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated atta

CVE-2026-8451 HIGH This Week POC

8.8 Jun 30

Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a

CVE-2025-5349 HIGH This Week POC

8.8 Jun 17

Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent

CVE-2023-4967 HIGH This Week POC

7.5 Oct 27

Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV

CVE-2014-2881 CRITICAL Act Now

10.0 May 01

Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix

CVE-2014-2882 CRITICAL Act Now

10.0 May 01

Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler

CVE-2026-8655 HIGH This Week

8.8 Jun 30

Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod

CVE-2026-13474 HIGH This Week

8.7 Jun 30

Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive

Same weakness CWE-94 – Code Injection

View all

CVE-2021-22205 CRITICAL POC

10.0

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2013-3906 HIGH POC

7.8

CVE-2017-9822 HIGH POC

8.8

CVE-2018-7602 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

Threat IntelligenceMISP

Threat Actors

INC Ransom

ATT&CK Techniques (observed)

T1190 - Exploit Public-Facing Application

Sources: MITRE ATT&CK, Metasploit/Nuclei

References

Advisories & patches

ADVISORY https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back