ZeroDay Findings
Sign inSign up

Findings

CVE-2020-8196

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Published Jul 10, 2020 · updated Jun 16, 2026 · citrix application delivery controller firmware

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 10, 2020 · Catalog

    Detected

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe citrix/application delivery controller firmwareversion unspecified
  • cpe citrix/gateway firmwareversion unspecified
  • cpe citrix/netscaler gateway firmwareversion unspecified
  • cpe citrix/sd-wan wanopversion unspecified
  • vendor Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Applianceversion unspecified

Sources

  • CISA KEVCVE-2020-8196

    Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

    cisa.gov
  • CVE.orgCVE-2020-8196

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-8196

    30-day exploitation probability 26.3%

    first.org
  • NIST NVDCVE-2020-8196

    Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References