{"id":"CVE-2023-4966","published":"2023-10-10T14:15:10Z","modified":"2026-07-31T04:16:44Z","title":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","vendor":"Citrix","product":"NetScaler ADC and NetScaler Gateway","tier":"core","eol":null,"description":{"text":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.","provenance":"source","from":"NVD"},"summary":{"text":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that affects deployments configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Through this flaw, an attacker with network access can cause sensitive information to be disclosed, requiring no authentication, no privileges, and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:46Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99997,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-10-18","dueDate":"2023-11-08","ransomware":true,"requiredAction":"Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.","notes":"https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/, https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-4966","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-10-17","exploitedFirstSeen":"2023-10-17","ransomware":true,"evidence":[{"url":"https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","date":"2023-10-17"},{"url":"https://www.mandiant.com/resources/blog/remediation-netscaler-adc-gateway-cve-2023-4966","date":"2023-10-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-10-18"},{"url":"https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2023-4966","date":"2023-10-31"},{"url":"https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed","date":"2023-11-07"},{"url":"https://cyble.com/blog/active-exploitation-of-big-ip-and-citrix-vulnerabilities-observed-by-cyble-global-sensor-intelligence-network/","date":"2023-11-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2023-4966","date":"2023-11-13"},{"url":"https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-breach-banks-law-firms-and-governments-4220580bfcee","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-14&host_type=src&vulnerability=cve-2023-4966","date":"2023-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2023-4966","date":"2023-11-15"}],"evidenceTotal":1122,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://support.citrix.com/article/CTX579459","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://support.citrix.com/article/CTX579459","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966","tags":["US Government Resource"]}],"techniques":[{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.  ","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.","confidence":"high"},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This is a buffer overflow vulnerability that results in unauthorized disclosure of memory, including session tokens.","confidence":"low","confidenceNote":"Windows-only technique on a non-Windows product"}],"reports":[{"id":"SRC-69c48a8dfa48e4fbb916","title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":null,"mentions":[{"quote":"Apart from CVE-2023-46805 and CVE-2024-21887, Mandiant has previously observed UNC5221 conducting zero day exploitation of CVE-2023-4966, impacting NetScaler ADC and NetScaler Gateway appliances.","start":25766,"end":25961}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-54802","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54802","exploited":true,"exploitedSince":"2023-10-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":13,"skipped":1,"earliest":"2023-10-24","earliestUrl":"https://github.com/Chocapikk/CVE-2023-4966","repos":[{"name":"Chocapikk/CVE-2023-4966","url":"https://github.com/Chocapikk/CVE-2023-4966","stars":78,"created":"2023-10-24"},{"name":"dinosn/citrix_cve-2023-4966","url":"https://github.com/dinosn/citrix_cve-2023-4966","stars":10,"created":"2023-10-25"},{"name":"RevoltSecurities/CVE-2023-4966","url":"https://github.com/RevoltSecurities/CVE-2023-4966","stars":10,"created":"2023-10-29"},{"name":"mlynchcogent/CVE-2023-4966-POC","url":"https://github.com/mlynchcogent/CVE-2023-4966-POC","stars":8,"created":"2023-10-25"},{"name":"certat/citrix-logchecker","url":"https://github.com/certat/citrix-logchecker","stars":5,"created":"2023-10-28"}]},"metasploit":[{"name":"Citrix ADC (NetScaler) Bleed Scanner","module":"auxiliary/scanner/http/citrix_bleed_cve_2023_4966","type":"auxiliary","disclosureDate":"2023-10-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/citrix_bleed_cve_2023_4966.rb"}],"nuclei":[{"id":"CVE-2023-4966","name":"Citrix Bleed - Leaking Session Tokens","severity":"high","path":"http/cves/2023/CVE-2023-4966.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-4966.yaml"}],"first":{"date":"2023-10-24","source":"PoC-in-GitHub","url":"https://github.com/Chocapikk/CVE-2023-4966"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy","id":"aee7681f-b53d-4594-a9de-ac51e6ad3362","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","techniques":["T1190"]},{"title":"CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver","id":"a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1","level":"high","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","techniques":["T1190"]},{"title":"CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy","id":"ff349b81-617f-4af4-924f-dbe8ea9bab41","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml","techniques":["T1190"]},{"title":"CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver","id":"87c83d8e-5390-44ce-aa4a-d3b37e54d0a0","level":"medium","status":"test","path":"rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html"],"flow":[{"stage":"exploitation","techniques":["T1574"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"},{"stage":"related","techniques":["T1134.001"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2023-10-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4966","provenance":"source"},{"date":"2023-10-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967","provenance":"source"},{"date":"2023-10-18","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-10-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54802","provenance":"source"},{"date":"2023-10-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2023-10-25","url":"https://github.com/Chocapikk/CVE-2023-4966","provenance":"source"}],"speed":{"daysToPublicExploit":14,"firstExploitFrom":"PoC-in-GitHub","daysToKev":8},"priority":{"score":82.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1109 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 13 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-citrix-netscaler-adc-and-netscaler-gateway-cwe-119"}}