ZeroDay Findings
Sign inSign up

Findings

CVE-2017-6316

Citrix Multiple Products Remote Code Execution Vulnerability

Published Jul 19, 2017 · updated Jun 16, 2026 · citrix netscaler sd-wan

A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 19, 2017 · Catalog

    Detected

    A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

  2. Mar 25, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Apr 15, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

Required action

Apply updates per vendor instructions.

CISA due date Apr 15, 2022

Affected

  • cpe citrix/netscaler sd-wanversion unspecified
  • vendor Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Serverversion unspecified

Sources

  • CISA KEVCVE-2017-6316

    A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

    cisa.gov
  • CVE.orgCVE-2017-6316

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2017-6316

    30-day exploitation probability 73.0%

    first.org
  • Exploit Database42345

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit Database42346

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2017-6316

    Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.

    nvd.nist.gov

References