Sessionwright

Known exploited

CVE-2023-3519: what NetScaler® admins need to do

CVE-2023-3519 (RCE) affects NetScaler ADC and Gateway. In CISA KEV since 2023-07-19. Fixed in 13.1-49.13 (14.1 not affected). Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2023-3519Request an emergency upgrade

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1 not affected / 13.1-49.13First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2023-07-19, federal due date 2023-08-09. Known ransomware use: Known.
Forensic triage
No forensic triage flag on this KEV entry.
CVSS
9.8 (CVSS v3.1, vendor score in CTX561482)
Preconditions
Configured as Gateway or AAA virtual server
Session kill advised
No. The bulletin does not call for session termination.

Fixed builds from the Citrix® security bulletin CTX561482

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.1Not affected14.1 was not yet generally available
NetScaler 13.1Past end of maintenance13.1-49.1313.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.159 FIPS13.1-37.283 FIPS
NetScaler 13.0End of life: migrate13.0-91.13
NetScaler 12.1 FIPS/NDcPP12.1-55.297 FIPS12.1-55.297 FIPS

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler ADC and NetScaler Gateway).

Our advisory data, taken from CTX561482, summarises it as: Unauthenticated remote code execution. Vulnerability class: unauthenticated RCE (code injection) (CWE-94). Precondition: Configured as Gateway or AAA virtual server.

For the full description, read the CVE.org record for CVE-2023-3519 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway or AAA virtual server. Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2023-3519 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2023-3519 highlighted

How to patch

  1. Choose the target build: at least 13.1-49.13 on 13.1. Prefer the current safe build (13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin

The bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • CISA AA23-201A webshell and persistence checks (run with -newermt <last install date>)

    find /netscaler/ns_gui/ -type f -name '*.php' -newermt <last-install-date>
find /var/vpn/ -type f -newermt <last-install-date>
find /var/netscaler/logon/ -type f -newermt <last-install-date>
find /var/python/ -type f -newermt <last-install-date>
zgrep '\.sh' /var/log/httperror.log*
zgrep '\.php' /var/log/httperror.log*
grep '/flash/nsconfig/keys' /var/log/sh.log*
find /var -perm -4000 -user root -not -path '/var/nslog/*'

    Tools: CISA AA23-201A, Fox-IT iocitrix.py (offline image triage), Mandiant ioc-scanner-CVE-2023-3519.sh

    Source: CISA AA23-201A; Fox-IT (69% of backdoored NetScalers were already patched)

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX561482 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date

Related CVEs

  • CVE-2023-3466Reflected cross-site scriptingNot in KEVSame bulletin (CTX561482)
  • CVE-2023-3467Privilege escalation to nsrootNot in KEVSame bulletin (CTX561482)
Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2023-3519: questions

Which NetScaler builds fix CVE-2023-3519?

Vendor bulletin CTX561482 fixes CVE-2023-3519 in 13.1-49.13 (NetScaler 13.1), 13.1-37.159 FIPS (NetScaler 13.1 FIPS/NDcPP), 13.0-91.13 (NetScaler 13.0, now end of life) and 12.1-55.297 FIPS (NetScaler 12.1 FIPS/NDcPP). NetScaler 14.1 is not affected. As of 2026-10-15, the current safe builds, which also include later fixes, are 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2023-3519 exploited in the wild?

Yes. CISA added CVE-2023-3519 to the Known Exploited Vulnerabilities catalog on 2023-07-19, with a federal remediation due date of 2023-08-09. Known ransomware campaign use: Known.

Do I need to kill sessions after patching CVE-2023-3519?

The bulletin does not call for session termination.

Check every appliance, not just one, for CVE-2023-3519

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment