CVE-2023-24487: Citrix Application Delivery Controller

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Arbitrary file read in Citrix ADC and Citrix Gateway 

Affected products

• Citrix Application Delivery Controller: from 12.1, before 12.1-55.296 (fixed in 12.1-55.296); from 12.1, before 12.1-65.35 (fixed in 12.1-65.35); from 13.0, before 13.0-90.11 (fixed in 13.0-90.11); from 13.1, before 13.1-37.150 (fixed in 13.1-37.150); from 13.1, before 13.1-45.61 (fixed in 13.1-45.61)
• Citrix Gateway: from 12.1, before 12.1-65.35 (fixed in 12.1-65.35); from 13.0, before 13.0-90.11 (fixed in 13.0-90.11); from 13.1, before 13.1-45.61 (fixed in 13.1-45.61)

Published 2023-07-10. Last modified 2026-06-17.