All vulnerabilities

Servers and applications

CVE-2023-3519

Unauthenticated remote code execution

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 19 Jul 2023.

Severity: Critical 9.8
Published: 19 Jul 2023
Last changed: 5 Aug 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 12.1-55.297, 13.0-91.13, 13.1-37.159, 13.1-49.13
Sources: NVD

Affected software

Software	Affected versions
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_application_delivery_controller`	From 12.1 before 12.1-55.297 From 13.0 before 13.0-91.13 From 13.1 before 13.1-37.159 From 13.1 before 13.1-49.13
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_gateway`	From 13.0 before 13.0-91.13 From 13.1 before 13.1-49.13

Known exploited

CISA name: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies: 9 Aug 2023
Used in ransomware: Yes, known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-3519
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-3519