CVE-2020-8193 Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass

Exploited in the wild Medium 6.5 Published 10 Jul 2020 Updated 21 Oct 2025

Unauthenticated attackers can access restricted URL endpoints in Citrix ADC and Gateway products due to improper access control.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-8193?

CVE-2020-8193 is a medium-severity missing authorization vulnerability in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP, published on 10 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.

Weakness: CWE-287, CWE-284

Which versions are affected by CVE-2020-8193?

It affects 4 products.

Products include Citrix Application Delivery Controller Firmware, Citrix Gateway Firmware, Citrix Netscaler Gateway Firmware, Citrix Sd-Wan Wanop.

How do I fix CVE-2020-8193?

No fix has been published for CVE-2020-8193 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-8193 being exploited?

Yes. Attackers have exploited CVE-2020-8193 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.

Sources

Also known as GHSA-wrxp-682m-vm9p.