What is the CVSS score of CVE-2023-3519?

CVE-2023-3519 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.8%.

Is there a public PoC exploit available for CVE-2023-3519?

Yes, a public proof-of-concept exploit is available for CVE-2023-3519. Prioritise patching immediately. EPSS: 93.8%.

How to fix or mitigate CVE-2023-3519?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

CVE-2023-3519

CRITICAL

Code Injection (CWE-94)

2023-07-19 secure@citrix.com

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Added to CISA KEV

Oct 24, 2025 - 13:42 cisa

CISA KEV

EUVD Exploitation Confirmed

Oct 24, 2025 - 13:42 euvd

EUVD KEV

PoC Detected

Oct 24, 2025 - 13:42 vuln.today

Public exploit code

CVE Published

Jul 19, 2023 - 18:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated remote code execution

AnalysisAI

Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in summer 2023, with thousands of appliances compromised before patches were applied.

Technical ContextAI

The code injection vulnerability allows unauthenticated attackers to execute arbitrary code on NetScaler appliances through crafted requests. The flaw exists in the NSPPE (NetScaler Perl Processing Engine) and can be exploited remotely without credentials.

Affected ProductsAI

Citrix NetScaler ADC and Gateway (multiple versions)

RemediationAI

Apply Citrix patches. Assume compromise if running vulnerable versions during the exploitation window. Check for web shells, modified configurations, and unauthorized accounts. Rotate all credentials that transited the appliance.