CVE-2021-22956: Citrix Application Delivery Controller Firmware

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attacker with access to NSIP or SNIP with management interface access to cause a temporary disruption of the Management GUI, Nitro API, and RPC communication.

Affected products

• Citrix Application Delivery Controller Firmware: before 11.1-65.23 (fixed in 11.1-65.23); from 12.1, before 12.1-63.22 (fixed in 12.1-63.22); from 13.0, before 13.0-83.27 (fixed in 13.0-83.27)
• Citrix Gateway: before 11.1-65.23 (fixed in 11.1-65.23); from 12.1, before 12.1-63.22 (fixed in 12.1-63.22); from 13.0, before 13.0-65.23 (fixed in 13.0-65.23)
• Citrix SD-WAN: before 10.2.9c (fixed in 10.2.9c); from 11.4.0, before 11.4.2 (fixed in 11.4.2)

Published 2021-12-07. Last modified 2026-06-17.