Citrix NetScaler ADC and Gateway Information Disclosure & Session Hijacking (Citrix Bleed, CVE-2023-4966)
Executive & SecOps Summary
SECOPS ASSESSMENTNetScaler ADC and NetScaler Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Unauthenticated remote attackers can trigger a memory buffer over-read to leak active session tokens, bypassing Multi-Factor Authentication (MFA) to hijack sessions
Immediately apply the official vendor security patches and terminate all active user sessions to invalidate potentially compromised tokens
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Access the NetScaler CLI to verify the current version and proceed with the installation of the patched firmware release.
# Check current NetScaler version
show version
# Extract and run the installation script in the FreeBSD shell
shell
tar -zxvf build_package_name.tgz
./installns2. Temporary Workaround & Hardening Configuration
Before patching, restrict external access to the vulnerable OIDC endpoints using an upstream Web Application Firewall (WAF) or reverse proxy.
# Example block rule on an upstream Nginx reverse proxy
location ~* ^/oauth/idp/\.well-known/openid-configuration {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Applying the patch does not invalidate session tokens that have already been stolen. You must terminate all active sessions immediately after upgrading.
# Display and terminate all active VPN sessions via NetScaler CLI
show vpn session
clear vpn session -all
# Terminate all active AAA sessions
clear aaa session -allStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, widely known as 'Citrix Bleed', is a buffer over-read vulnerability (CWE-119) residing in the OpenID Connect (OIDC) discovery endpoint of NetScaler ADC and Gateway. Due to insufficient bounds checking when processing HTTP requests, the system responds with adjacent memory contents that exceed the intended buffer size.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker sends a crafted HTTP GET request to specific endpoints, such as /oauth/idp/.well-known/openid-configuration. The device responds with a payload containing raw memory data, which frequently includes active session cookies belonging to authenticated users and administrators. By extracting these tokens and injecting them into their own browser sessions, attackers can completely bypass credentials and MFA requirements to gain unauthorized access.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild by ransomware groups and state-sponsored threat actors. Because NetScaler appliances serve as the primary gateway to internal corporate networks, successful exploitation often leads to lateral movement, domain controller compromise, and widespread ransomware deployment.
Official Vendor Advisories & References
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Frequently Asked SecOps Questions (CVE-2023-4966)
FAQQ1. How critical is CVE-2023-4966 and is it actively exploited in the wild?
CVE-2023-4966 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-4966?
Primary impacted vendors include citrix, netscaler across netscaler adc, netscaler gateway. Scope summary: NetScaler ADC and NetScaler Gateway versions 14.1, 13.1, 13.0, 12.1, and FIPS editions configured as a Gateway or AAA virtual server
Q3. What temporary mitigations or workarounds exist for CVE-2023-4966 before patching?
[Mitigation] Immediately apply the official vendor security patches and terminate all active user sessions to invalidate potentially compromised tokens Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-4966
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (citrix)
View Category →Citrix NetScaler ADC and Gateway Memory Overflow Vulnerability (CVE-2026-8452) Critical Security Advisory
[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Security Advisory for NetScaler ADC and Gateway Denial of Service (DoS) Vulnerability (CVE-2026-88779)
[Affected Scope] NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28.
Citrix NetScaler ADC and Gateway Remote Code Execution (RCE) and DoS Vulnerability (CVE-2026-88772)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.
Citrix NetScaler ADC and Gateway Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-88771)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.