What is the CVSS score of CVE-2023-4966?

CVE-2023-4966 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 94.3%.

Which versions of NetScaler ADC are affected by CVE-2023-4966?

Citrix NetScaler ADC and Gateway appliances face immediate risk from a critical memory disclosure vulnerability ('Citrix Bleed') that allows unauthenticated remote attackers to extract valid session…

Is there a public PoC exploit available for CVE-2023-4966?

Yes, a public proof-of-concept exploit is available for CVE-2023-4966. Prioritise patching immediately. EPSS: 94.3%.

How to fix or mitigate CVE-2023-4966?

Within 24 hours: inventory all Citrix NetScaler ADC and Gateway instances and prioritize those configured as Gateway or AAA virtual servers; implement strict firewall rules restricting network access to NetScaler appliances from external sources; establish baseline monitoring and alerting for exploitation attempts. Within 7 days: deploy Web Application Firewall rules to block known Citrix Bleed exploitation patterns; enable comprehensive session and authentication logging with real-time review for anomalous token usage; implement session re-validation checks on critical applications. Within 30 days: prepare migration to a patched Citrix NetScaler version when released by vendor; conduct 90-day retroactive forensic analysis of authentication logs for indicators of compromise; architect network isolation to separate critical business applications from affected NetScaler instances pending permanent remediation.

NetScaler ADC CVE-2023-4966

HIGH

Buffer Overflow (CWE-119)

2023-10-10 secure@citrix.com

Buffer Overflow Information Disclosure Citrix Netscaler Application Delivery Controller Netscaler Gateway

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated buffer over-read needing no user interaction leaks memory (C:H); no direct integrity or availability impact at the base level, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 04:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 04:22 vuln.today

cvss_changed

Severity Changed

Jul 31, 2026 - 04:22 NVD

CRITICAL HIGH

CVSS changed

Jul 31, 2026 - 04:22 NVD

9.4 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Mar 26, 2026 - 11:19 vuln.today

Added to CISA KEV

Oct 24, 2025 - 13:42 cisa

CISA KEV

CVE Published

Oct 10, 2023 - 14:15 nvd

CRITICAL 9.4

DescriptionNVD

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

AnalysisAI

Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows remote unauthenticated attackers to leak memory contents, including valid session tokens, when the appliance is configured as a Gateway or AAA virtual server. This is confirmed actively exploited (CISA KEV) with publicly available exploit code and an EPSS score of 94.35% (100th percentile), and leaked tokens enable session hijacking that bypasses multifactor authentication.

Technical ContextAI

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are network appliances providing application delivery, load balancing, and secure remote-access VPN/ICA proxy services. The flaw is rooted in a buffer over-read (CWE-119, improper restriction of operations within memory buffer bounds); a crafted HTTP request to the Gateway/AAA endpoint causes the appliance to return more data from an adjacent memory buffer than intended. Affected products per CPE include citrix:netscaler_application_delivery_controller (in standard, FIPS, and NDcPP builds) and citrix:netscaler_gateway. Because the over-read returns residual heap memory, it frequently discloses previously-authenticated user session tokens that can be replayed.

RemediationAI

Vendor-released patch: upgrade to NetScaler ADC/Gateway 14.1-8.50, 13.1-49.15, 13.0-92.19, 13.1-FIPS 13.1-37.164, 12.1-FIPS 12.1-55.300, or 12.1-NDcPP 12.1-55.300 or later, per Citrix advisory https://support.citrix.com/article/CTX579459. End-of-life 12.1 and 13.0 builds must be migrated to a supported, patched branch. Critically, patching alone is insufficient because leaked tokens persist: after upgrading, terminate all active and persistent sessions by running 'kill icaconnection -all', 'kill rdp connection -all', 'kill pcoipConnection -all', 'kill aaa session -all', and 'clear lb persistentSessions' to invalidate any session tokens an attacker may have already harvested. If immediate patching is impossible, restrict network access to the Gateway/AAA virtual server endpoints and monitor for anomalous authenticated sessions; note that restricting access may disrupt legitimate remote users, which is the trade-off of this compensating control.