ZeroDay Findings
Sign inSign up

Findings

CVE-2020-8193

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Published Jul 10, 2020 · updated Jun 16, 2026 · citrix application delivery controller firmware

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 10, 2020 · Catalog

    Detected

    Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe citrix/application delivery controller firmwareversion unspecified
  • cpe citrix/gateway firmwareversion unspecified
  • cpe citrix/netscaler gateway firmwareversion unspecified
  • cpe citrix/sd-wan wanopversion unspecified
  • vendor Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Applianceversion unspecified

Sources

  • CISA KEVCVE-2020-8193

    Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

    cisa.gov
  • CVE.orgCVE-2020-8193

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-8193

    30-day exploitation probability 88.4%

    first.org
  • NIST NVDCVE-2020-8193

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References