{"id":"CVE-2020-8195","kind":"vulnerability","aliases":["CVE-2020-8195"],"related":[],"title":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability","description":"Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.","summary":"Citrix ADC, Citrix Gateway and certain Citrix SD-WAN WANOP appliances leak information to unauthenticated or remote parties. CISA lists it as actively exploited in the wild, and attackers can use the leaked data to support further attacks against the appliance.","severity":"medium","cvss":6.5,"epss":0.33029,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix-adc","citrix-gateway","exploited","infrastructure","sd-wan-wanop","self-hosted"],"not_affected_if":["managed-hosting","unaffected-models"],"how_to_check":null,"fix":"Apply the Citrix update for the affected ADC, Gateway or SD-WAN WANOP build per vendor instructions (CISA's required action). Affected versions: unknown from sources.","status":"open","published_at":"2020-07-10T16:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:48+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:33:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Citrix update for the affected ADC, Gateway or SD-WAN WANOP build per vendor instructions (CISA's required action). Affected versions: unknown from sources.","reach":"internet","impact":"medium","summary":"Citrix ADC, Citrix Gateway and certain Citrix SD-WAN WANOP appliances leak information to unauthenticated or remote parties. CISA lists it as actively exploited in the wild, and attackers can use the leaked data to support further attacks against the appliance.","category":"infrastructure","who_cares":["citrix-adc","citrix-gateway","sd-wan-wanop","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads sensitive appliance information, possibly aiding further compromise","analyst_note":"Find the affected version list and the exact leaked data type from the Citrix security bulletin for CVE-2020-8195; the sources here give no versions or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","unaffected-models"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":2910,"output_tokens":419,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected version list and the exact leaked data type from the Citrix security bulletin for CVE-2020-8195; the sources here give no versions or check steps.","search":"'-2020':26A,29A '-57.18':114C '-58.30':112C '-63.21':116C '-64.14':118C '-70.18':121C '-8195':27A,30A '10.2.7':135C '10.5':120C '11.0.3':132C '11.1':117C '11.1.1':130C '12.0':115C '12.1':113C '13.0':111C 'activ':81B 'adc':5A,14A,35A,45B,59B,105C 'and':37A 'applianc':12A,21A,69B,99B 'appliance':42A 'applic':2A 'application':32A 'attack':87B,96B 'certain':63B 'cisa':77B 'citrix':1A,13A,31A,44B,47B,58B,60B,64B,104C,107C,123C 'citrix-adc':43B 'citrix-gateway':46B 'control':4A 'controller':34A 'cve':25A,28A 'd':133C 'data':92B 'deliveri':3A 'delivery':33A 'disclosur':23A,140C 'exploit':49B,82B 'gateway':6A,15A,36A,48B,61B,108C 'host':57B 'improp':100C 'inform':22A,71B,139C 'infrastructur':50B 'input':101C 'leak':70B,91B 'limit':138C 'list':78B 'low':142C 'op':127C 'parti':76B 'privileg':143C 'remot':75B 'result':136C 'sd':9A,18A,39A,52B,66B 'sd-wan':8A,17A,38A,65B 'sd-wan-wanop':51B 'sdwan':124C 'self':56B 'self-host':55B 'support':94B 'unauthent':73B 'use':89B 'user':144C 'valid':102C 'version':109C,128C 'vulner':24A 'wan':10A,19A,40A,53B,67B,126C 'wan-op':125C 'wanop':11A,20A,41A,54B,68B 'wild':85B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-10T16:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-8195","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8195","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2020-8195","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-8195","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-8195","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8195","severity":null,"published_at":"2020-07-10T16:15:12+00:00","modified_at":"2026-06-17T03:26:01+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}