An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0.

Summary

Citrix Application Delivery Controller (ADC) and Citrix Gateway products are affected by this vulnerability, which allows an attacker to use directory traversal to access files and directories outside the intended area on the system. This could expose sensitive information stored on the affected appliance.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Dec 27, 2019, 1:06 PM UTCCVE published
2. Nov 3, 2021Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. May 3, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Aug 12, 2026, 3:55 AM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 10