CVE-2011-2593: Citrix Access Gateway Plug-In

Medium severity, CVSS 6.8. EPSS: 4% chance of exploitation in the next 30 days.

Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow.

Affected products

• Citrix Access Gateway Plug-In: up to and including 9.3; version 10.0 only

Published 2014-08-12. Last modified 2026-06-16.