The short answer
- Affected
- NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
- Fixed in
- 14.1-12.35 / 13.1-51.15First fixed builds for 14.1 / 13.1. All releases in the table below.
- Current safe build
- 14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
- CISA KEV
- Added 2024-01-17, federal due date 2024-02-07. Known ransomware use: Unknown.
- Forensic triage
- No forensic triage flag on this KEV entry.
- CVSS
- 8.2 (CVSS v3.1, vendor score in CTX584986)
- Preconditions
- Configured as Gateway or AAA virtual server
- Session kill advised
- No. The bulletin does not call for session termination.
Fixed builds from the Citrix® security bulletin CTX584986
| Release | First fixed build | Current safe build |
|---|---|---|
| NetScaler 14.1 | 14.1-12.35 | 14.1-73.46 |
| NetScaler 13.1Past end of maintenance | 13.1-51.15 | 13.1-64.29 |
| NetScaler 13.1 FIPS/NDcPPPast end of maintenance | 13.1-37.176 FIPS | 13.1-37.283 FIPS |
| NetScaler 13.0End of life: migrate | 13.0-92.21 | |
| NetScaler 12.1 FIPS/NDcPP | 12.1-55.302 FIPS | 12.1-55.302 FIPS |
FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.
What it is
“Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability”
Our advisory data, taken from CTX584986, summarises it as: Denial of service / out-of-bounds read. Vulnerability class: buffer overflow (CWE-119). Precondition: Configured as Gateway or AAA virtual server.
For the full description, read the CVE.org record for CVE-2023-6549 and the vendor bulletin.
Am I affected?
Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway or AAA virtual server. Find the build with show ns version on the CLI.
Enter your build to check it against CVE-2023-6549 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.
Open the checker with CVE-2023-6549 highlightedHow to patch
- Choose the target build: at least
14.1-12.35on 14.1 or13.1-51.15on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above. - Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
- Confirm the build on each node with
show ns version, then work through the post-patch steps below.
13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.
After patching
Steps in the vendor bulletin
vendor bulletin- Restrict NSIP/SNIP management access to a dedicated management network (Never expose NSIP or management SNIP to the internet.)
The bulletin does not call for session termination.
Timeline
- Vendor bulletin CTX584986 published with fixed builds
- Added to the CISA Known Exploited Vulnerabilities catalog
- CISA federal remediation due date
Related CVEs
- CVE-2023-6548Authenticated (low-privilege) remote code execution on the management interfaceCISA KEVSame bulletin (CTX584986)
Sources
- Vendor bulletin: CTX584986, NetScaler ADC and Gateway security bulletin for CVE-2023-6548 and CVE-2023-6549 (published 2024-01-16)
- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-6549
- CISA KEV catalog JSON feed, version 2026.10.15: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.