Unauthenticated command execution in Citrix NetScaler ADC and Citrix NetScaler Gateway

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

• Citrix NetScaler ADC and Citrix NetScaler Gateway, 14.1 branch: Affected before 14.1-73.37.
• Citrix NetScaler ADC and Citrix NetScaler Gateway, 13.1 branch: Affected before 13.1-64.23.
• Citrix NetScaler ADC 14.1-FIPS: Affected before 14.1-73.37 FIPS.
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP: Citrix's bulletin gives the affected boundary as before 13.1-37.279, while its upgrade guidance names build 13.1.37.279; the supplied record expresses this branch as before 13.1.37.279 FIPS and NDcPP. Validate the build naming against the current vendor bulletin before marking an appliance unaffected.
• The bulletin covers customer-managed deployments. NetScaler instances used in Secure Private Access Hybrid are also affected. Citrix states that Citrix-managed cloud services and Citrix-managed Adaptive Authentication are updated by the provider.

Citrix NetScaler ADC and Citrix NetScaler Gateway do not adequately validate attacker-controlled input, enabling remote command execution. The weakness is classified as CWE-20: Improper Input Validation and applies to all ADC and Gateway deployments, including default configurations, with no additional feature required. The attacker can reach the service over the network without authentication or user interaction; the normalized record also classifies attack complexity as low. The reviewed sources do not identify the input field, endpoint, parser, function, or execution privilege involved, so those implementation details remain unknown.

The issue is remotely reachable and can be exploited without authentication or user interaction. The normalized record marks the vulnerability as known exploited and as having a public exploit; Citrix also states that exploitation of the issue has been observed on unmitigated NetScaler deployments. The reviewed bulletin does not provide exploit code, payloads, a target endpoint, campaign, victim, or specific indicators. Customer-managed appliances within the affected scope should therefore be treated as exposed until upgraded, rather than waiting for confirmed intrusion evidence.

Successful exploitation can provide arbitrary command execution on Citrix NetScaler ADC or Citrix NetScaler Gateway. The technical outcome may affect the appliance's confidentiality, integrity, and availability, including access to data readable by the appliance, unauthorized configuration changes, or service disruption. The effect on backend systems depends on process privileges, network placement, and configured connections; the available sources do not establish a specific lateral-movement path, persistence mechanism, or target system. The lack of an authentication requirement and the applicability to default configurations substantially reduce the conditions needed to begin an attack.

• Edge appliance and access services: Command execution on ADC or Gateway could alter traffic handling, access policies, or service state, causing disruption or unauthorized traffic changes.
• Data and secrets: Depending on process privileges and deployment design, an attacker could access data handled by the appliance or configuration information readable by it.
• System integrity: An attacker could make unauthorized appliance changes or use the appliance as a foothold toward connected services.
• Limit: The available evidence does not establish the exact execution privilege, specific downstream systems affected, or a particular data-breach scenario.

1. Upgrade immediately affected Citrix NetScaler ADC and Citrix NetScaler Gateway deployments to the builds identified by Citrix:

• 14.1 branch: 14.1-73.37 and later releases within the 14.1 branch.
• 13.1 branch: 13.1-64.23 and later releases within the 13.1 branch.
• ADC 14.1-FIPS: 14.1-73.37 FIPS and later releases within the 14.1-FIPS branch.
• ADC 13.1-FIPS and 13.1-NDcPP: 13.1.37.279 and later releases within the corresponding branches.

1. Inventory standalone appliances, HA pairs, and NetScaler instances used in Secure Private Access Hybrid. Do not limit the review to appliances with optional features enabled because the issue affects the default configuration.
2. For FIPS and NDcPP deployments, confirm the exact build label and release branch before selecting an update. Citrix's bulletin uses different notation for the 13.1-37.279 affected boundary and the 13.1.37.279 upgrade build.
3. After upgrading, verify the installed build on each appliance and review configuration changes, administrative accounts, access logs, and unusual activity during the period in which the appliance was unpatched.
4. The reviewed sources do not document a CVE-specific workaround that replaces upgrading. Disabling an optional feature should not be treated as sufficient because Citrix states that no additional feature is required for exploitation.

1. Inventory all customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway appliances, including NetScaler instances used in Secure Private Access Hybrid deployments.
2. Check the running build on every appliance and compare it with the branch-specific boundaries in affected_summary; do not use optional feature checks to exclude exposure because the issue does not require an additional feature.
3. Identify FIPS and NDcPP appliances so that the correct branch-specific build is evaluated.
4. Review access logs, configuration changes, administrative activity, and unusual connections after identifying appliances that were exposed before remediation. This is precautionary monitoring, not a vendor-confirmed IOC.
5. The reviewed bulletin does not provide a vulnerability-specific log signature or IOC list. Absence of suspicious events must not be treated as proof that an appliance was not compromised.