High severity · published Nov 12, 2024
CVE-2024-8535
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP…
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as an Auth Server (AAA Vserver) with KCDAccount configuration for Kerberos SSO to access backend resources
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
NetScaler ADC · Citrix
12.1 before 12.1-55.321; 12.1 before 12.1-55.321; 12.1 before 13.1-55.34; 13.1 before 13.1-37.207; 14.1 before 14.1-29.72 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8535
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8535
Vendor Advisory
https://support.citrix.com/s/article/CTX691608-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20248534-and-cve20248535?language=en_US
More from NetScaler ADC
9.8
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service