CVE-2023-3519

Unauthenticated remote code execution

Critical9.8Known exploitedEPSS 99.7%

Published: 19 Jul 2023
Updated: 5 Aug 2026
Reserved: 5 Jul 2023
Assigned by: Citrix

Description

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability.

Added: 19 Jul 2023
Fix due (US federal): 9 Aug 2023
Used by ransomware: Known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Scores

CVSS scores of CVE-2023-3519, by who scored it
Scored by	CVSS	Score	Vector
CitrixCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 99.7% · top 0.1% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

Citrix · NetScaler ADC
- affected 13.1 – < 49.13
- affected 13.0 – < 91.13
- affected 13.1-FIPS – < 37.159
- affected 12.1-FIPS – < 55.297
- affected 12.1-NDcPP – < 55.297
Citrix · NetScaler Gateway
- affected 13.1 – < 49.13
- affected 13.0 – < 91.13

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-3519](https://trackcve.app/badge/CVE-2023-3519.svg)](https://trackcve.app/cve/CVE-2023-3519)

Record last updated 5 Aug 2026, 03:55 UTC.