CVE-2020-8299: Citrix Application Delivery Controller Firmware

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. Note that the attacker must be in the same Layer 2 network segment as the vulnerable appliance.

Affected products

• Citrix Application Delivery Controller Firmware: from 11.1, before 11.1-65.20 (fixed in 11.1-65.20); from 12.1, before 12.1-61.18 (fixed in 12.1-61.18); from 13.0, before 13.0-76.29 (fixed in 13.0-76.29); from 12.1, before 12.1-55.238 (fixed in 12.1-55.238)
• Citrix Gateway: from 12.1, before 12.1-61.18 (fixed in 12.1-61.18); from 13.0, before 13.0-76.29 (fixed in 13.0-76.29)
• Citrix NetScaler Gateway: from 11.1, before 11.1-65.20 (fixed in 11.1-65.20)
• Citrix SD-WAN WANOP: from 10.2, before 10.2.9a (fixed in 10.2.9a); from 11.1, before 11.1.2c (fixed in 11.1.2c); from 11.2, before 11.2.3a (fixed in 11.2.3a); from 11.3, before 11.3.2 (fixed in 11.3.2)

Published 2021-06-16. Last modified 2026-06-17.