Description

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-27T17:16:56.260Z",
  "pubdate": "2026-09-27T17:16:56.260Z",
  "executiveSummary": "This vulnerability is an improper input validation flaw affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, which permits unauthenticated remote code execution (RCE).\nThe vulnerability originates from a failure to sufficiently sanitize or validate input data processed by the targeted products, allowing an attacker to inject and execute arbitrary commands with the privileges of the underlying application service.\nImpacted versions include ADC versions prior to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1.37.279 FIPS/NDcPP, as well as Gateway versions prior to 14.1-73.37 and 13.1-64.23.\nThe risk implication is critical, as it facilitates full system compromise by unauthenticated remote actors without the requirement for prior credentials.\nExploitation requires network access to the management or data plane interfaces exposed by the affected appliances. The ability to execute arbitrary commands grants the adversary complete control over the appliance, enabling data exfiltration, lateral movement within the environment, and persistence mechanisms.",
  "technicalDetails": "The vulnerability is rooted in an improper input validation mechanism within the Citrix NetScaler ADC and Gateway architecture. This flaw allows an attacker to bypass security filters by submitting maliciously crafted input to specific vulnerable components of the appliance.\nIn its typical operation, the affected appliance processes incoming requests across various network protocols. The vulnerability arises when input parameters are passed to system-level functions or command interpreters without adequate validation or sanitization against injection patterns. By injecting arbitrary commands into these parameters, an attacker can influence the execution flow of the underlying operating system or management shell.\nThe exploitation process generally follows a sequence where an unauthenticated attacker transmits a specially crafted network request to an exposed endpoint of the Citrix NetScaler instance. Because the application fails to enforce strict bounds or character filtering on user-supplied data, the payload is parsed and executed by the appliance's backend processes. This effectively transforms a standard administrative or data-plane interaction into a command injection vector.\nThe vulnerable component serves as a gateway or entry point that interacts with internal system resources. Upon successful injection, the payload is executed with the privileges of the NetScaler web service or management process, which often possesses elevated system permissions. This allows the attacker to bypass authentication mechanisms entirely, as the exploit executes before or independently of legitimate session establishment.\nPost-exploitation impact is severe, as the attacker achieves remote code execution (RCE). Once command execution is established, the attacker can leverage standard system tools to conduct reconnaissance, deploy web shells for persistent access, modify configuration files, or intercept traffic traversing the gateway. Since the appliance is often positioned at the network perimeter, this compromise provides a strategic foothold for deeper penetration into the target network. The lack of authentication requirements significantly lowers the barrier to entry, enabling automated scanning and exploitation by malicious actors globally. The exploitation does not rely on complex memory corruption techniques, but rather on the logical failure of the application to treat untrusted input as strictly data, leading to the interpretation of this data as executable commands within the shell context."
}