CVE-2021-22919

HIGH

7.5

CVSS Score

Published: August 5, 2021 at 08:16 PM UTC

Updated: June 17, 2026 at 03:38 AM UTC

21 products affected across 1 vendorNetScaler GatewayGatewayApplication Delivery Controller Firmware

Using Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP by N/A?

Get instant alerts when new vulnerabilities affect Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.9%

Description

A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway), and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO. These vulnerabilities, if exploited, could lead to the limited available disk space on the appliances being fully consumed.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Application Delivery Controller Firmware · Citrix

95%

11.1 ≤ v < 11.1-65.2212.1 ≤ v < 12.1-55.23812.1 ≤ v < 12.1-62.2713.0 ≤ v < 13.0-82.45

Affected range stops below 11.1-65.22, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-55.238, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1-62.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.45, so it looks safe — our inference, not a vendor statement

citrix-mpx-15030-50g-fips (environment) · citrix-mpx-15040-50g-fips (environment) · citrix-mpx-15060-50g-fips (environment) · citrix-mpx-15080-50g-fips (environment) · citrix-mpx-15100-50g-fips (environment) · citrix-mpx-15120-50g-fips (environment) · citrix-mpx-8905-fips (environment) · citrix-mpx-8910-fips (environment) · citrix-mpx-8920-fips (environment) · citrix-mpx-sdx-14030-fips (environment) · citrix-mpx-sdx-14060-fips (environment) · citrix-mpx-sdx-14080-fips (environment) · citrix-application-delivery-controller (same device)

Gateway · Citrix

95%

v ≥ 13.0-82.4512.1 ≤ v < 12.1-62.2713.0 ≤ v < 13.0-82.45

Affected range stops below 12.1-62.27, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.0-82.45, so it looks safe — our inference, not a vendor statement

NetScaler Gateway · Citrix

95%

11.1 ≤ v < 11.1-65.22

Affected range stops below 11.1-65.22, so it looks safe — our inference, not a vendor statement

Sd WAN Wanop · Citrix

95%

v ≥ 13.0-82.4510.2 ≤ v < 10.2.9.b11.2 ≤ v < 11.2.3.b11.3 ≤ v < 11.3.2.a11.4 ≤ v < 11.4.0.a

Affected range stops below 10.2.9.b, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.2.3.b, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.3.2.a, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.4.0.a, so it looks safe — our inference, not a vendor statement

citrix-4000-wo (environment) · citrix-4100-wo (environment) · citrix-5000-wo (environment) · citrix-5100-wo (environment)

Application Delivery Controller · Citrix

60%

v ≥ 13.0-82.45

4000-Wo · Citrixdevice

80%

All versions

4100-Wo · Citrixdevice

80%

All versions

5000-Wo · Citrixdevice

80%

All versions

5100-Wo · Citrixdevice

80%

All versions

Mpx 15030-50G Fips · Citrixdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.citrix.com/article/CTX319135

References (1)

x_refsource_MISCVendor Advisory

Source: [email protected]

https://support.citrix.com/article/CTX319135

CVSS

7.5HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card