EUVD-2026-62395
GHSA-7c6h-rhhv-wm8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated with no interaction (AV:N/AC:L/PR:N/UI:N); impacts mirror the vendor's high VC/VI/VA, though the info-disclosure tag suggests I/A may be lower and should be verified.
Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).
CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Articles & Coverage 1
AnalysisAI
Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.1 before 63.21) allows remote attackers to access sensitive data over the network without credentials or user interaction. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with high impact to the vulnerable appliance; no public exploit identified at time of analysis and no CISA KEV listing is present in the provided data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an affected NetScaler ADC or NetScaler Gateway running 14.1 (up to 73.32) or 13.1 (up to 63.21); per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed against a reachable instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuinely high-priority issue rather than an inflated score: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact to the vulnerable system, meaning a remote, unauthenticated attacker can exploit default-facing configurations with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: consult Citrix article CTX696939 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939) for the exact fixed builds and upgrade to a firmware version above the affected 14.1 (through 73.32) and 13.1 (through 63.21) ranges on both ADC and Gateway; the precise fixed version numbers were not included in the provided data and must be taken from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all NetScaler ADC and Gateway appliances running 14.1.x prior to 14.1-73.32 or 13.1.x prior to 13.1-63.21; assess internet exposure and implement network-layer access restrictions (firewall IP whitelisting, VPN enforcement) to limit remote reachability. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s
Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows
Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un
Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended
Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated atta
Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a
Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent
Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV
Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix
Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler
Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod
Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today