CVE-2021-22920: Citrix Application Delivery Management

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to a phishing attack through a SAML authentication hijack to steal a valid user session.

Affected products

• Citrix Application Delivery Management: version 12.1-62.25 only; version 13.0-82.42 only
• Citrix Gateway: version 12.1-62.25 only; version 13.0-82.42 only

Published 2021-08-05. Last modified 2026-06-17.