{"id":"CVE-2023-3519","published":"2023-07-19T18:15:11Z","modified":"2026-08-05T05:16:39Z","title":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","tier":"core","eol":null,"description":{"text":"Unauthenticated remote code execution","provenance":"source","from":"NVD"},"summary":{"text":"A code injection flaw in Citrix NetScaler ADC and NetScaler Gateway allows an attacker to inject and run code on affected appliances. The attack requires only network access to the device, with no authentication, no user interaction, and no special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99749,"percentile":0.99954,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-07-19","dueDate":"2023-08-09","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467;  https://nvd.nist.gov/vuln/detail/CVE-2023-3519","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-07-18","exploitedFirstSeen":"2023-07-18","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2023/07/18/citrix-releases-security-updates-netscaler-adc-and-gateway","date":"2023-07-18"},{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","date":"2023-07-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-07-19"},{"url":"https://cisa.gov/news-events/alerts/2023/07/20/cisa-releases-cybersecurity-advisory-threat-actors-exploiting-citrix-cve-2023-3519","date":"2023-07-20"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20"},{"url":"https://www.mandiant.com/resources/blog/citrix-zero-day-espionage","date":"2023-07-21"},{"url":"https://twitter.com/Shadowserver/status/1686778896962797576","date":"2023-08-02"},{"url":"https://stairwell.com/resources/citrix-cve-2023-3519-stairwell-identifies-new-attack-methods/","date":"2023-08-11"},{"url":"https://www.mandiant.com/resources/blog/citrix-adc-vulnerability-ioc-scanner","date":"2023-08-14"},{"url":"https://research.nccgroup.com/2023/08/15/approximately-2000-citrix-netscalers-backdoored-in-mass-exploitation-campaign/","date":"2023-08-15"}],"evidenceTotal":139,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability","url":"https://otx.alienvault.com/pulse/6ae28386158c5f73da5c681b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-3519","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.","confidence":"high"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.","confidence":"high"},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Injection","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability allows for unauthenticated remote code execution. This can be exploited via an HTTP GET request that triggers a stack buffer overflow.  Adversaries have been observed to use this exploitation to drop a webshell on a target machine and subsequently discover, collect, and exfiltrate active directory data.","confidence":"high"}],"reports":[{"id":"SRC-d849a763c1dde7c77634","title":"Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella","publisher":"trendmicro.com","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","date":"2024-11-19","mentions":[{"quote":"LAC reported the multiple campaigns, abusing Array AG (CVE-2023-28461) and Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.","start":27361,"end":27552}]},{"id":"SRC-2f295c8bc3326bfff68f","title":"Dark Web Profile: INC Ransom","publisher":"socradar.io","url":"https://socradar.io/blog/dark-web-profile-inc-ransom/","date":"2024-01-24","mentions":[{"quote":"a combination of advanced techniques, including spear-phishing campaigns to gain initial access, exploitation of known vulnerabilities (such as CVE-2023-3519 in Citrix NetScaler), and the use of both Commercial Off-The-Shelf (COTS) softwares and legitimate system tools (LOLBINs) for reconnaissance and lateral","start":1349,"end":1659},{"quote":"Their attack methodology combines initial access through spear-phishing or exploiting vulnerabilities, such as CVE-2023-3519 in Citrix NetScaler, with a series of calculated steps to establish control and execute their ransomware.","start":2354,"end":2584}]},{"id":"SRC-bf1b3fd29c4a38dbdb8c","title":"Picus-RedReport-2024","publisher":"picussecurity.com","url":"https://www.picussecurity.com/hubfs/Red%20Report%202024/Picus-RedReport-2024.pdf","date":null,"mentions":[{"quote":"In a notable instance involving the exploitation of Citrix CVE-2023-3519, detailed in CISA's","start":106166,"end":106258},{"quote":"[23]“Threat Actors Exploiting Citrix CVE-2023-3519","start":374162,"end":374212},{"quote":"cve-2023-3519_to_implant_webshells.pdf","start":374334,"end":374372}]},{"id":"SRC-98d41f50cd6136602da0","title":"Return of the Higaisa APT","publisher":"zscaler.com","url":"https://www.zscaler.com:443/blogs/security-research/return-higaisa-apt","date":null,"mentions":[{"quote":"Security Advisory: Remote Code Execution Vulnerability (CVE-2023-3519)","start":38132,"end":38202}]},{"id":"SRC-3b104e5309765da01558","title":"APT-31 Leverages COVID-19 Vaccine Theme","publisher":"zscaler.com","url":"https://www.zscaler.com:443/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online","date":null,"mentions":[{"quote":"Security Advisory: Remote Code Execution Vulnerability (CVE-2023-3519)","start":28222,"end":28292}]},{"id":"SRC-38bda43b08b98cd5f0a3","title":"Technical Analysis of PureCrypter","publisher":"zscaler.com","url":"https://www.zscaler.com:443/blogs/security-research/technical-analysis-purecrypter","date":null,"mentions":[{"quote":"Security Advisory: Remote Code Execution Vulnerability (CVE-2023-3519)","start":21392,"end":21462}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-44176","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44176","exploited":true,"exploitedSince":"2023-07-19","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":13,"skipped":0,"earliest":"2023-07-20","earliestUrl":"https://github.com/telekom-security/cve-2023-3519-citrix-scanner","repos":[{"name":"BishopFox/CVE-2023-3519","url":"https://github.com/BishopFox/CVE-2023-3519","stars":228,"created":"2023-07-21"},{"name":"securekomodo/citrixInspector","url":"https://github.com/securekomodo/citrixInspector","stars":96,"created":"2023-07-20"},{"name":"mandiant/citrix-ioc-scanner-cve-2023-3519","url":"https://github.com/mandiant/citrix-ioc-scanner-cve-2023-3519","stars":65,"created":"2023-08-10"},{"name":"telekom-security/cve-2023-3519-citrix-scanner","url":"https://github.com/telekom-security/cve-2023-3519-citrix-scanner","stars":54,"created":"2023-07-20"},{"name":"mr-r3b00t/CVE-2023-3519","url":"https://github.com/mr-r3b00t/CVE-2023-3519","stars":13,"created":"2023-07-21"}]},"metasploit":[{"name":"Citrix ADC (NetScaler) Forms SSO Target RCE","module":"exploit/freebsd/http/citrix_formssso_target_rce","type":"exploit","disclosureDate":"2023-07-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_formssso_target_rce.rb"}],"nuclei":[{"id":"CVE-2023-3519","name":"Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution","severity":"critical","path":"http/cves/2023/CVE-2023-3519.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-3519.yaml"}],"first":{"date":"2023-07-18","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_formssso_target_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/173997/Citrix-ADC-NetScaler-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190","T1574"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1087.002"],"provenance":"source"}],"timeline":[{"date":"2023-07-18","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-07-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/citrix_formssso_target_rce.rb","provenance":"source"},{"date":"2023-07-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2023/07/18/citrix-releases-security-updates-netscaler-adc-and-gateway","provenance":"source"},{"date":"2023-07-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3519","provenance":"source"},{"date":"2023-07-19","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-07-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44176","provenance":"source"},{"date":"2024-01-24","kind":"report","label":"Named in socradar.io: Dark Web Profile: INC Ransom","url":"https://socradar.io/blog/dark-web-profile-inc-ransom/","provenance":"machine"},{"date":"2024-11-19","kind":"report","label":"Named in trendmicro.com: Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The…","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":0},"priority":{"score":89.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1199 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":10.0,"detail":"6 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 13 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}