CVE-2023-3519: critical vulnerability in Citrix NetScaler ADC
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
An attacker can run malicious code on the affected system without needing to log in or have permission. This is extremely dangerous because it gives complete control of the system to an unauthorized person.
An unauthenticated remote attacker can execute arbitrary code through an input validation flaw (CWE-94: Code Injection), likely via network-accessible endpoints. No credentials or prior access required; successful exploitation grants full system compromise with the privileges of the affected application.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.