All vulnerabilities
CVE-2023-4966

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Citrix NetScaler ADC and NetScaler GatewayNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationExploited in the wildAdded to KEV 18 Oct 2023. Known ransomware useCISA KEV
Exploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.50Also 49.15, 92.19 and 2 moreCVE List
Federal deadline8 Nov 2023Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 10 Oct 2023, 13:12 UTCPublishedCVE List
  2. 18 Oct 2023Added to CISA KEVCISA KEV
  3. 25 Oct 2023Exploit code publicMetasploit

Public exploit code and templates 2

  • Auxiliary moduleCitrix ADC (NetScaler) Bleed Scanner 25 Oct 2023Metasploit
  • Scanner templateCitrix Bleed - Leaking Session TokensNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Text from CVE List

Affected versions 9

  • NetScaler ADCaffected: 14.1 before 8.50CVE List
  • NetScaler ADCaffected: 13.1 before 49.15CVE List
  • NetScaler ADCaffected: 13.0 before 92.19CVE List
  • NetScaler ADCaffected: 13.1-FIPS before 37.164CVE List
  • NetScaler ADCaffected: 12.1-FIPS before 55.300CVE List
  • NetScaler ADCaffected: 12.1-NDcPP before 55.300CVE List
  • NetScaler Gatewayaffected: 14.1 before 8.50CVE List
  • NetScaler Gatewayaffected: 13.1 before 49.15CVE List
  • NetScaler Gatewayaffected: 13.0 before 92.19CVE List

References 4