CVE-2017-6316VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2017-6316: Citrix Multiple Products Remote Code Execution Vulnerability

Affects Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile ServerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 73.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-6316 (opens in a new tab)

Description

CVE-2017-6316 is a high-severity remote code execution vulnerability affecting the management interfaces of Citrix NetScaler SD-WAN Enterprise and Standard Edition, Citrix CloudBridge Virtual WAN Edition, and XenMobile Server. An unauthenticated remote attacker could exploit this flaw to execute arbitrary code with root privileges. This vulnerability has been exploited in the wild. No explicit patch or remediation information is provided in the input data.

Summary

This vulnerability exists in the management interface of multiple Citrix products including NetScaler SD-WAN Enterprise and Standard Edition, CloudBridge Virtual WAN Edition, and XenMobile Server. It allows an unauthenticated remote attacker to execute arbitrary code as root, potentially compromising the entire system. The vulnerability is tracked as CVE-2017-6316 and is associated with CWE-20 (Improper Input Validation). Exploitation has been observed in the wild, indicating active threat usage.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with root privileges on affected Citrix products, leading to full system compromise. This poses a significant risk to confidentiality, integrity, and availability of affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are confirmed, restrict access to management interfaces and monitor for suspicious activity related to this vulnerability.

Weaknesses

CWE-20Improper Input Validation (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:56:59 UTC

Weaknesses

References

Related threats