ZeroDay Findings
Sign inSign up

Findings

CVE-2023-4966

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Published Oct 10, 2023 · updated Jul 30, 2026 · citrix netscaler application delivery controller

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 10, 2023 · Catalog

    Detected

    Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

  2. Oct 18, 2023 · CISA KEV

    Known exploited

    Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

  3. Nov 8, 2023 · CISA KEV

    Remediation due

    Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

  4. Jul 30, 2026 · Catalog

    Updated

    Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Required action

Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

CISA due date Nov 8, 2023

Affected

  • cpe citrix/netscaler application delivery controllerversion unspecified
  • cpe citrix/netscaler gatewayversion unspecified
  • vendor Citrix NetScaler ADC and NetScaler Gatewayversion unspecified

Sources

  • CISA KEVCVE-2023-4966

    Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

    cisa.gov
  • CVE.orgCVE-2023-4966

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-4966

    30-day exploitation probability 100.0%

    first.org
  • Metasploit Modulesauxiliary_scanner/http/citrix_bleed_cve_2023_4966

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2023-4966

    Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References