---
title: "Security digest: October 10, 2023"
url: https://erroneo.us/security/2023-10-10/
description: "October 10, 2023 vulnerability digest: 2 briefs (Citrix Bleed, HTTP/2 Rapid Reset); 5 CISA KEV additions (Adobe, Cisco, IETF, Microsoft). What to patch and…"
type: security-digest-day
section: "Security Digest"
date_published: 2023-10-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: October 10, 2023

2 editorial briefs and 5 known exploited (cisa kev) additions.

## Take stock

- Act now: Citrix Bleed . Every organization running customer-managed NetScaler ADC or Gateway as a VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server, especially on end-of-life 12.1 or 13.0 builds.
- Check exposure: HTTP/2 Rapid Reset . Anyone terminating HTTP/2 directly on self-managed servers, proxies, or app runtimes (NGINX, Tomcat, Node.js, Go, nghttp2-based stacks) that are reachable from the internet.
- Do you run any of these? IETF HTTP/2, Microsoft Skype for Business, Microsoft WordPad, Adobe Acrobat and Reader, Cisco IOS and IOS XE. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-10-31.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Citrix Bleed: NetScaler Gateway Leaks Session Tokens](https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/index.md): If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.
- **Check exposure** [HTTP/2 Rapid Reset: Record DDoS Flaw in HTTP/2 Servers](https://erroneo.us/security/briefs/http2-rapid-reset-ddos-cve-2023-44487/index.md): This is availability-only and was exploited at record scale, but if your HTTP/2 traffic terminates at a major CDN or cloud load balancer the provider already absorbed it; check what terminates HTTP/2 on your own servers.

## Known exploited (CISA KEV)

- [CVE-2023-44487](https://erroneo.us/security/cve/CVE-2023-44487/index.md) IETF HTTP/2: HTTP/2 Rapid Reset Attack Vulnerability (CISA due 2023-10-31)
- [CVE-2023-41763](https://erroneo.us/security/cve/CVE-2023-41763/index.md) Microsoft Skype for Business: Microsoft Skype for Business Privilege Escalation Vulnerability (CISA due 2023-10-31)
- [CVE-2023-36563](https://erroneo.us/security/cve/CVE-2023-36563/index.md) Microsoft WordPad: Microsoft WordPad Information Disclosure Vulnerability (CISA due 2023-10-31)
- [CVE-2023-21608](https://erroneo.us/security/cve/CVE-2023-21608/index.md) Adobe Acrobat and Reader: Adobe Acrobat and Reader Use-After-Free Vulnerability (CISA due 2023-10-31)
- [CVE-2023-20109](https://erroneo.us/security/cve/CVE-2023-20109/index.md) Cisco IOS and IOS XE: Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability (CISA due 2023-10-31)

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2023-10-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt