The flaw resides in the Citrix Application Delivery Controller and Gateway.
Source: Threadpost