CVE-2020-8300: Citrix Application Delivery Controller Firmware

Medium severity, CVSS 6.5. EPSS: 3% chance of exploitation in the next 30 days.

Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway must be configured as a SAML SP or a SAML IdP for this to be possible.

Affected products

• Citrix Application Delivery Controller Firmware: from 11.1, before 11.1-65.20 (fixed in 11.1-65.20); from 12.1, before 12.1-62.23 (fixed in 12.1-62.23); from 13.0, before 13.0-82.41 (fixed in 13.0-82.41); from 12.1, before 12.1-55.238 (fixed in 12.1-55.238)
• Citrix Gateway: from 12.1, before 12.1-62.23 (fixed in 12.1-62.23); from 13.0, before 13.0-82.41 (fixed in 13.0-82.41)
• Citrix NetScaler Gateway: from 11.1, before 11.1-65.20 (fixed in 11.1-65.20)

Published 2021-06-16. Last modified 2026-06-17.