CVE-2016-4945: Citrix NetScaler Gateway 11.0 Firmware

Medium severity, CVSS 6.1. EPSS: 1.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie.

Affected products

• Citrix NetScaler Gateway 11.0 Firmware: up to and including 65.35

Published 2016-06-01. Last modified 2026-06-17.