Servers and applications

CVE-2023-6549

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 17 Jan 2024.

Severity: High 7.5
Published: 17 Jan 2024
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 12.1-55.302, 13.0-92.21, 13.1-37.176, 13.1-51.15, 14.1-12.35
Sources: NVD

Affected software

Software	Affected versions
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_application_delivery_controller`	From 12.1 before 12.1-55.302 From 13.0 before 13.0-92.21 From 13.1 before 13.1-37.176 From 13.1 before 13.1-51.15 From 14.1 before 14.1-12.35
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_gateway`	From 13.0 before 13.0-92.21 From 13.1 before 13.1-51.15 From 14.1 before 14.1-12.35

Known exploited

CISA name: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due for US agencies: 7 Feb 2024
Used in ransomware: Not known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-6549
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-6549