What is CVE-2019-6485?

CVE-2019-6485 is a medium-severity vulnerability in Citrix Netscaler Application Delivery Controller, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 5.9/10. Published 2019-02-22.

How severe is CVE-2019-6485?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2019-6485 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Citrix Netscaler Application Delivery Controller

CVE-2019-6485

Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled.

Vulnerability class: POODLE (CVE-2014-3566)

Published 2019-02-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.023 (83.2th percentile), scored 2026-10-23.

Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000

Affected products

Citrix Netscaler Application Delivery Controller
Citrix Netscaler Application Delivery Controller Firmware — versions 10.5, 11.0, 11.1
Citrix Netscaler Gateway
Citrix Netscaler Gateway Firmware — versions 10.5, 11.0, 11.1

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

Public proof-of-concept exploits

tls-attacker/TLS-Padding-Oracles

References

github.com/RUB-NDS/TLS-Padding-Oracles (Product, Third Party Advisory)
support.citrix.com/article/CTX240139 (Patch, Mitigation, Vendor Advisory)
www.securityfocus.com/bid/106783 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2019-6485?: CVE-2019-6485 is a medium-severity vulnerability in Citrix Netscaler Application Delivery Controller, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 5.9/10. Published 2019-02-22.
How severe is CVE-2019-6485?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2019-6485 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.