Hundreds of Citrix NetScaler ADC and Gateway servers breached, exploiting a critical code injection vulnerability

August 4, 2023

Hundreds of Citrix NetScaler ADC and Gateway servers breached, exploiting a critical code injection vulnerability

In a concerning development for cybersecurity, hundreds of Citrix NetScaler ADC and Gateway servers have fallen victim to malicious actors who exploited a critical code injection vulnerability. Referred to as CVE-2023-3519, this flaw could potentially lead to unauthenticated remote code execution.

Details of the vulnerability

The code injection vulnerability, which Citrix addressed through a patch last month, carries a CVSS score of 9.8. This high score underscores the severity and potential impact of the flaw. Such a vulnerability can expose organizations to significant risks and leave them vulnerable to cyberattacks.

Scope of the breach

The reach of this breach spans across several countries. The largest number of impacted IP addresses is found in Germany, followed by France, Switzerland, Italy, Sweden, Spain, Japan, China, Austria, and Brazil. This highlights the global impact of the vulnerability and the need for organizations worldwide to remain vigilant in their cybersecurity efforts.

Previous disclosures

The exploitation of CVE-2023-3519 to deploy web shells was previously disclosed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). This highlights the importance of promptly addressing and mitigating such vulnerabilities by organizations to prevent unauthorized access and potential data breaches.

Discovery of an Additional Flaw

In addition to the CVE-2023-3519 exploit, another critical flaw in Citrix ShareFile software, known as CVE-2023-24489, was recently detected. GreyNoise, a cybersecurity firm, reported three IP addresses attempting to exploit this vulnerability. Citrix has promptly addressed the issue in ShareFile storage zones controller version 5.11.24 and subsequent updates.

Technical details of the bug

The bug present in Citrix ShareFile software can be traced back to a simpler version of a padding oracle attack. It has been identified that the default values for AES encryption in .NET are Cipher Block Chaining (CBC) mode and PKCS#7 padding. A potential padding oracle attack can be identified by observing how the system behaves when a different type of padding is provided. This technical insight highlights the complexity of the vulnerability and the importance of strong cybersecurity measures.

These recent breaches of Citrix NetScaler ADC and Gateway servers shed light on the critical need for organizations to promptly patch vulnerabilities and ensure robust cybersecurity measures. The exploitation of the CVE-2023-3519 and CVE-2023-24489 vulnerabilities demonstrates the constant and evolving threats faced by businesses and individuals alike. It is crucial that organizations remain proactive in their approach, regularly updating and patching their systems to prevent unauthorized access and potential data breaches. These incidents serve as a reminder of the ever-present risks and the need for continuous vigilance in safeguarding sensitive information.

Explore more

Standardized Developer Environments Still Break DevOps Workflows

August 18, 2026

The long-standing engineering dream of achieving absolute environment parity has often remained an elusive target, despite the sophisticated containerization tools available to modern teams. For years, the industry has chased the promise of a setup so consistent that a developer could transition from a local laptop to a cloud-based server without changing a single line of configuration. While 2026 has

Retailers Use ERP, SCM, and CRM to Drive Growth in 2026

August 18, 2026

Modern supply chain management systems go beyond simple inventory tracking by using operational data to forecast demand and redistribute stock across multiple channels. This evolution represents a fundamental shift in how the retail industry operates, where the sheer volume of digital transactions and global logistics has reached unprecedented levels of complexity. As high-growth brands navigate the current landscape, the reliance

Morph Launches Non-Custodial Global Payment Gateway

August 18, 2026

For globally distributed teams, the delay of several business days required for traditional wire transfers to clear represents a substantial hurdle to efficient payroll and operations. This pervasive friction has paved the way for the introduction of Morph Payments, a decentralized gateway designed specifically to leverage the high throughput and low cost of the Morph Ethereum Layer 2 scaling network.

Is Ethereum Finally Adopting Cardano’s UTXO Model?

August 18, 2026

Algorand Foundation ambassador Lily Brodi recently noted that Ethereum’s newest scaling explorations essentially mirror the technical state Cardano has operated in for several years. This observation highlights a significant pivot in the ongoing evolution of decentralized ledgers, where the rigid distinction between account-based and Unspent Transaction Output (UTXO) models is beginning to blur. For years, the blockchain community viewed these

How Do You Measure the Success of Your Onboarding Program?

August 18, 2026

While many HR departments prioritize the delivery of administrative paperwork, only twelve percent of employees report that their organization provides a high-quality onboarding experience. This disconnect suggests that most companies view the arrival of new talent as a logistical hurdle rather than a long-term investment. Organizations often excel at the technicalities of the hiring process, such as distributing hardware, establishing