Is CVE-2017-6316 actively exploited?

Yes. CVE-2017-6316 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2017-6316 be exploited remotely?

The attack vector of CVE-2017-6316 has not been classified yet.

What is the CVSS score of CVE-2017-6316?

CVE-2017-6316 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2017-6316

HIGHCISA KEVIN THE WILD

CVE-2017-6316

Published: March 25, 2022

EPSS:87.79%probability of exploitation in 30 daysPercentile:99.5th

Official Description

A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

NVD Source

CISA KEV Advisory

Citrix Multiple Products Remote Code Execution Vulnerability

Added to KEV: 2022-03-25Federal patch deadline: 2022-04-15

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This vulnerability in Citrix NetScaler SD-WAN and CloudBridge Virtual WAN allows an unauthenticated, remote attacker to execute arbitrary code as a root user through the management interface. The high EPSS score of 0.87787 indicates a very high likelihood of exploitation, and its inclusion in CISA's KEV confirms it has been actively exploited in the wild, making it an urgent concern.

Active exploitation of this vulnerability has been observed in the wild. Given the nature of the flaw, it is remotely exploitable without authentication.

Recommended Action

Organizations should apply available patches for Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition. Additionally, restrict access to the management interface to trusted networks and users.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2017-6316 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2017-6316 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.