CVE-2021-22919: Citrix Application Delivery Controller Firmware

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.

Affected products

• Citrix Application Delivery Controller Firmware: from 11.1, before 11.1-65.22 (fixed in 11.1-65.22); from 12.1, before 12.1-62.27 (fixed in 12.1-62.27); from 13.0, before 13.0-82.45 (fixed in 13.0-82.45); from 12.1, before 12.1-55.238 (fixed in 12.1-55.238)
• Citrix Gateway: from 12.1, before 12.1-62.27 (fixed in 12.1-62.27); from 13.0, before 13.0-82.45 (fixed in 13.0-82.45)
• Citrix NetScaler Gateway: from 11.1, before 11.1-65.22 (fixed in 11.1-65.22)
• Citrix SD-WAN WANOP: from 10.2, before 10.2.9.b (fixed in 10.2.9.b); from 11.2, before 11.2.3.b (fixed in 11.2.3.b); from 11.3, before 11.3.2.a (fixed in 11.3.2.a); from 11.4, before 11.4.0.a (fixed in 11.4.0.a)

Published 2021-08-05. Last modified 2026-06-17.