Is CVE-2023-6548 (Citrix NetScaler ADC and NetScaler Gateway Code Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2023-6548 to its Known Exploited Vulnerabilities catalogue on 17 January 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

What this CVE means for NetScaler exposure

Because CISA placed CVE-2023-6548 in the Known Exploited Vulnerabilities catalogue, the practical question is not whether the flaw is real, but whether any Internet-facing Citrix NetScaler ADC or NetScaler Gateway instance still exposes the management interface path described in the advisory. For teams running remote access through Citrix, this is a perimeter risk with immediate triage value.

The right first pass is to confirm whether the affected service is present in your environment, whether management access is reachable from untrusted networks, and whether the product is used for user-facing remote access or administrative control. For edge appliances, exposure often lives in the same place as business continuity, so inventory accuracy matters as much as patch speed.

If your environment includes VPN or gateway services, use the VPN Security Guide and the Remote Access Identity Guide to check whether the appliance is still doing more than simple tunnelling, such as brokering privileged access or acting as a trust anchor for downstream systems.

Why exploited edge appliances deserve faster treatment

KEV listing is a strong signal that exploitation has moved beyond theoretical risk. For edge appliances, that usually means attackers are interested in the access boundary itself, either to gain execution on the device or to use the device as a stepping stone into internal networks. Once a gateway or ADC is compromised, the blast radius can extend to sessions, credentials, and trusted connections that were never meant to be exposed externally.

CISA Known Exploited Vulnerabilities Catalog is the authoritative source for confirming that exploitation is considered active, while the NIST National Vulnerability Database and CVE Program are the places to verify the record metadata and vendor mapping without relying on secondary summaries.

If you need a broader response playbook for exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide gives a useful model for triage, emergency mitigation, and post-patch hunting when the window between disclosure and abuse is already closed.

What to do if patching is delayed

For this kind of issue, mitigation is not a substitute for fixing the exposed service, but it can reduce the chance of immediate abuse while maintenance is arranged. That usually means restricting who can reach the management interface, reviewing whether any temporary access path is broader than intended, and treating the appliance as potentially high-value until the fix is in place.

When patching must wait, the practical control is to reduce the exposed surface and raise your confidence in what is actually reachable. That includes tightening network access, checking for unexpected admin exposure, and watching for signs that the device has already been used as an initial foothold. The FIRST EPSS model can help prioritisation, but for a KEV-listed issue the operational priority should already be high.

If your estate uses Citrix for remote workforce access, the Virtual Desktop (VDI) and DaaS Security Guide is a useful companion because it frames gateway compromise in the wider context of session isolation, access governance, and the downstream trust placed in the platform.

Risk and Threat Considerations

Exploitation of a Citrix gateway or ADC is attractive because these devices sit at the boundary between internet traffic and internal access. A successful code-injection path can provide a durable foothold, visibility into traffic flows, or a route to harvest credentials and sessions that were already trusted by the organisation.

Failure mechanism: If the management interface is reachable and the vulnerable path is exercised before remediation, an attacker may obtain authenticated remote code execution and use the appliance as a launch point for deeper access, credential theft, or session abuse.

Impact: The likely consequence is not just device compromise, but loss of trust in the remote access boundary itself, which can force credential rotation, session invalidation, incident hunting, and in some cases appliance rebuild or service replacement.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Physical devices and systems are inventoried	Appliance exposure starts with knowing where NetScaler instances exist.
	PR.PS-01 — Configurations are managed and controlled	Mitigation depends on hardening and correcting exposed appliance configuration.
	DE.CM-01 — Networks and network services are monitored to find anomalies	Exploited edge devices require monitoring for abuse and post-exploitation activity.
Recommendation — Inventory every exposed appliance and verify its internet-facing role. Apply and verify the vendor fix, then lock down the management plane. Monitor the appliance and adjacent logs for abnormal access and execution patterns.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE is about fixing an actively exploited vulnerability.
	AC-4 — Information Flow Enforcement	Restricting management and user access paths is central to containment.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-exploitation checks rely on reviewing appliance and adjacent logs.
Recommendation — Remediate the flaw on every exposed instance as an urgent change. Limit who can reach the management interface and related trust paths. Review appliance logs and correlated network telemetry for abuse indicators.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed appliances require rapid prioritisation and verification.
	CIS-12 — Network Infrastructure Management	The issue concerns an edge network appliance and its exposure boundary.
	CIS-8 — Audit Log Management	Evidence of compromise depends on retained and reviewed logs.
Recommendation — Prioritise remediation of the KEV-listed appliance and confirm closure. Harden, segment, and monitor the network appliance and its admin paths. Centralise and review appliance logs before and after remediation.

Practitioner Guidance

What to verify: Confirm whether any Citrix NetScaler ADC or NetScaler Gateway instance is internet-reachable, whether the management plane is isolated, and whether the organisation has a reliable record of patch status for every exposed appliance. If the answer depends on tribal knowledge, treat that as a gap.

Decision rule: If the device is externally exposed and still within the risk window, prioritise emergency remediation over normal change windows, then investigate for compromise before assuming the patch alone resolved the issue. If service continuity prevents immediate repair, reduce exposure first and document the exception explicitly.

What practitioners underestimate: Appliance incidents often hide in plain sight because the device is seen as infrastructure rather than a high-value identity and access choke point. When a gateway is involved, session state, stored credentials, and downstream trust relationships may need review, not just the box itself.

Practitioner takeaway: For a KEV-listed edge appliance flaw, the key judgement is to treat the gateway as an active security boundary, not a passive network device, and to verify compromise risk before you assume remediation is complete.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org