gateway vulnerabilities and fixes

Recent CVEs affecting gateway, with upgrade or downgrade steps. 30 tracked.

gateway has 30 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 27. Most recent: 2026-01-12. Highest priority: CVE-2020-11543 (score 66/100).

• CVE-2026-22771 HIGH 8.8 UPGRADE Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati
• CVE-2025-24030 HIGH 7.1 UPGRADE Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based applicati
• CVE-2023-24488 MEDIUM 6.1 UPGRADE UPGRADE Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross s
• CVE-2023-24487 MEDIUM 6.3 UPGRADE UPGRADE Arbitrary file read in Citrix ADC and Citrix Gateway 
• CVE-2022-38368 HIGH 8.8 UPGRADE An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376
• CVE-2022-31805 HIGH 7.5 UPGRADE UPGRADE In the CODESYS Development System multiple components in multiple versions transmit the passwords for the comm
• CVE-2022-31804 HIGH 7.5 UPGRADE The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits
• CVE-2022-31803 MEDIUM 5.3 UPGRADE In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauth
• CVE-2022-31802 CRITICAL 9.8 UPGRADE In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been
• CVE-2022-27516 MEDIUM 5.3 UPGRADE UPGRADE User login brute force protection functionality bypass
• CVE-2022-27513 HIGH 8.3 UPGRADE UPGRADE Remote desktop takeover via phishing
• CVE-2022-27510 CRITICAL 9.8 UPGRADE UPGRADE Unauthorized access to Gateway user capabilities
• CVE-2022-27509 MEDIUM 6.1 UPGRADE UPGRADE Unauthenticated redirection to a malicious website
• CVE-2022-27508 HIGH 7.5 DOWNGRADE DOWNGRADE Unauthenticated denial of service
• CVE-2022-27507 MEDIUM 6.5 UPGRADE UPGRADE Authenticated denial of service
• CVE-2021-36764 HIGH 7.5 UPGRADE In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference
• CVE-2021-22927 HIGH 8.1 UPGRADE UPGRADE A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML servi
• CVE-2021-22920 MEDIUM 6.5 DOWNGRADE DOWNGRADE A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (former
• CVE-2021-22919 HIGH 7.5 UPGRADE UPGRADE A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (former
• CVE-2020-8300 MEDIUM 6.5 UPGRADE UPGRADE Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS bef
• CVE-2020-8299 MEDIUM 6.5 UPGRADE UPGRADE Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS b
• CVE-2020-8247 HIGH 8.8 UPGRADE UPGRADE Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15,
• CVE-2020-8246 HIGH 7.5 UPGRADE UPGRADE Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15,
• CVE-2020-8245 MEDIUM 6.1 UPGRADE UPGRADE Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Ga
• CVE-2020-13417 CRITICAL 9.8 UPGRADE UPGRADE An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete
• CVE-2020-13414 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in Aviatrix Controller before 5.4.1204
• CVE-2020-12714 MEDIUM 5.9 UPGRADE UPGRADE An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway
• CVE-2020-12713 HIGH 7.2 UPGRADE UPGRADE An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.
• CVE-2020-11543 CRITICAL 9.8 DOWNGRADE OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH acc
• CVE-2019-18177 MEDIUM 6.5 UPGRADE UPGRADE In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is

FAQ

How do I fix gateway vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is gateway being exploited right now?

None of the tracked gateway CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which gateway CVE should I patch first?

CVE-2020-11543 currently ranks highest (66/100): OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH acc.

RSS feed for gateway · ← Back to latest CVEs