Citrix SD-WAN WANOP vulnerabilities

10 CVEs affecting Citrix SD-WAN WANOP, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22919, published 2021-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-8193: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability, published 2020-07-10. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 88.3% chance of exploitation in the next 30 days. Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2020-8195: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability, published 2020-07-10. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 33% chance of exploitation in the next 30 days. Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2020-8196: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability, published 2020-07-10. Medium severity, CVSS 4.3. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 26.3% chance of exploitation in the next 30 days. Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2020-8191, published 2020-07-10. Medium severity, CVSS 6.1. EPSS: 23.5% chance of exploitation in the next 30 days. Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2020-8194, published 2020-07-10. Medium severity, CVSS 6.5. EPSS: 10.8% chance of exploitation in the next 30 days. Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2020-8246, published 2020-09-18. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix…
CVE-2020-8247, published 2020-09-18. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix…
CVE-2020-8198, published 2020-07-10. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and…
CVE-2021-22919, published 2021-08-05. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO,…
CVE-2020-8299, published 2021-06-16. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a,…