CVE-2023-6549

Timeline

Detection, updates, and resolution for this record.

1. Jan 17, 2024 · Catalog

   Detected

   Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

2. Jan 17, 2024 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Feb 7, 2024 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Affected

• cpe citrix/netscaler application delivery controllerversion unspecified
• cpe citrix/netscaler gatewayversion unspecified
• vendor Citrix NetScaler ADC and NetScaler Gatewayversion unspecified

Sources

• CISA KEVCVE-2023-6549

  Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

  cisa.gov
• CVE.orgCVE-2023-6549

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-6549

  30-day exploitation probability 57.6%

  first.org
• NIST NVDCVE-2023-6549

  Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• CISA note · support.citrix.com
• US Government Resource · cisa.gov