CVE-2018-6186: Citrix NetScaler

High severity, CVSS 8.8. EPSS: 3.1% chance of exploitation in the next 30 days.

Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/read_url URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges.

Affected products

• Citrix NetScaler: version 12.0 only

Published 2018-02-01. Last modified 2026-06-17.