CVE-2023-6549

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated…

High8.2Known exploitedEPSS 57.6%

Published: 17 Jan 2024
Updated: 21 Oct 2025
Reserved: 6 Dec 2023
Assigned by: Citrix

Description

Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability.

Added: 17 Jan 2024
Fix due (US federal): 7 Feb 2024
Used by ransomware: Not known

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Scores

CVSS scores of CVE-2023-6549, by who scored it
Scored by	CVSS	Score	Vector
CitrixCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVDNVD · Analyzed	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 57.6% · top 0.9% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer (opens in a new tab)All about CWE-119 and its CVEs

Affected products

Cloud Software Group · NetScaler ADC
- affected 14.1 – < 12.35
- affected 13.1 – < 51.15
- affected 13.0 – < 92.21
- affected 13.1-FIPS – < 37.176
- affected 12.1-FIPS – < 55.302
- affected 12.1-NDcPP – < 55.302

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-6549](https://trackcve.app/badge/CVE-2023-6549.svg)](https://trackcve.app/cve/CVE-2023-6549)

Record last updated 21 Oct 2025, 23:05 UTC.