---
title: "Citrix Bleed: NetScaler Gateway Leaks Session Tokens"
url: https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/
description: "CVE-2023-4966 leaks NetScaler AAA session cookies, bypassing MFA; ransomware used it. Patch to 14.1-8.50/13.1-49.15+ and kill all sessions."
type: security-brief
section: "Security Digest"
date_published: 2023-10-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2023-4966", "CVE-2023-4967"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Citrix Bleed: NetScaler Gateway Leaks Session Tokens

**Verdict: Act now.** If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.

- **Who must act:** Every organization running customer-managed NetScaler ADC or Gateway as a VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server, especially on end-of-life 12.1 or 13.0 builds.
- **Who can relax:** Users of Citrix-managed cloud services and Citrix-managed Adaptive Authentication, and appliances not configured as a Gateway or AAA virtual server.
- **Affected:** NetScaler ADC and Gateway 14.1 before 14.1-8.50; 13.1 before 13.1-49.15; 13.0 before 13.0-92.19; NetScaler ADC 13.1-FIPS before 13.1-37.164; 12.1-FIPS and 12.1-NDcPP before 12.1-55.300; 12.1 (end-of-life, vulnerable)
- **Fixed:** 14.1-8.50 and later; 13.1-49.15 and later; 13.0-92.19 and later; 13.1-FIPS 13.1-37.164 and later; 12.1-FIPS / 12.1-NDcPP 12.1-55.300 and later
- **CVEs:** CVE-2023-4966, CVE-2023-4967
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm the build with `show version` and upgrade to a fixed release; move off end-of-life 12.1 and 13.0 trains.
2. Immediately after upgrading run: `kill icaconnection -all`, `kill rdp connection -all`, `kill pcoipConnection -all`, `kill aaa session -all`, `clear lb persistentSessions`.
3. If you cannot patch at once, isolate the appliance from the internet as CISA advised.
4. Rotate credentials for identities that used the appliance during the exposure window.
5. Hunt for post-exploitation activity behind the gateway using the indicators in CISA AA23-325A.

### How to check if you are affected

- Search WAF or network logs for GET requests to `/oauth/idp/.well-known/openid-configuration` with unusually long Host headers; NetScaler itself does not log these.
- In ns.log TCPCONNSTAT events, flag sessions where Client_ip and Source differ, or one IP uses many accounts in a short window.
- Check users for logins from multiple public IPs or unexpected regions, and new accounts or remote tools (PuTTY, rclone) on internal hosts.
- If preserving evidence, take NSPPE core dumps before rebooting and look for very long strings of '0' characters.

## What happened

On October 10, 2023, Citrix (Cloud Software Group) published [bulletin CTX579459](https://support.citrix.com/s/article/CTX579459-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967) fixing CVE-2023-4966, a sensitive information disclosure, and CVE-2023-4967, a denial of service, in NetScaler ADC and NetScaler Gateway. The disclosure bug became known as "Citrix Bleed." Citrix scores it CVSS 9.4; [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4966) scores it 7.5 because it rates only confidentiality impact. In practice the leak is worse than a typical information disclosure.

[Assetnote's analysis](https://www.slcyber.io/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966), published October 24, traced it to unauthenticated OpenID configuration endpoints that build a response from the attacker-supplied Host header. The code trusted the return value of `snprintf` as the number of bytes written, so a long Host header made the appliance send back memory past a 0x20000-byte buffer. [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966) found that leaked memory can include a valid AAA session cookie issued after authentication, including MFA. Replaying it gives an attacker an authenticated session with no password or MFA token.

Mandiant saw zero-day exploitation starting in late August 2023. Citrix added exploitation reports to its bulletin on October 17; CISA listed it in the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on October 18, flagged for known ransomware use, and it remains there as of this writing. In November, [CISA advisory AA23-325A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a) described LockBit 3.0 affiliates using it against organizations across education, energy, finance, government, healthcare and transportation.

## Who is affected

Customer-managed appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, on builds before 14.1-8.50, 13.1-49.15, 13.0-92.19, 13.1-FIPS 13.1-37.164, or 12.1-FIPS/NDcPP 12.1-55.300. Version 12.1 is end-of-life and also vulnerable. Citrix-managed cloud services need no action.

## Do you really need to act?

Yes, if you run one of these as an internet-facing gateway, which is the usual purpose of the configuration. Exploitation needs no credentials, works with a single crafted GET request, and public analysis has been available since October 2023. The trap that caught many organizations: **patching does not invalidate sessions that were already stolen**. Citrix's [follow-up post](https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/) told customers to kill all active and persistent sessions after upgrading. If you patched without doing that during the exploitation window, treat the gap as a possible compromise. Appliances used only as plain load balancers, without Gateway or AAA, are outside the stated preconditions.

## What to do now

1. Run `show version` and upgrade to a fixed build; leave end-of-life trains.
2. Right after upgrading, run `kill icaconnection -all`, `kill rdp connection -all`, `kill pcoipConnection -all`, `kill aaa session -all` and `clear lb persistentSessions`.
3. If you cannot patch now, isolate the appliance from the internet, per CISA.
4. Rotate credentials for accounts that used the gateway during exposure.
5. Hunt behind the gateway for lateral movement using CISA's indicators.

## How to tell if you were hit

NetScaler does not log requests to the vulnerable endpoint, so Mandiant recommends checking WAF or network logs for GETs to `/oauth/idp/.well-known/openid-configuration` with abnormally long Host headers. In `ns.log`, look at TCPCONNSTAT events where `Client_ip` and `Source` differ, or one IP using many accounts quickly. Default log rotation keeps only about 2.5 MB, so check syslog forwarding. CISA adds signs downstream: new accounts, remote tools such as PuTTY or rclone, and logins from unexpected regions. Core dumps can show attempts but cannot tell failed from successful ones.

## Timeline

- Late Aug 2023 — Mandiant observes zero-day exploitation.
- Oct 10, 2023 — Citrix bulletin CTX579459 and fixed builds released.
- Oct 17, 2023 — Citrix updates bulletin with exploitation reports.
- Oct 18, 2023 — CISA adds CVE-2023-4966 to KEV.
- Oct 23, 2023 — NetScaler publishes session-kill guidance.
- Oct 24, 2023 — Assetnote publishes root-cause analysis.
- Nov 21, 2023 — CISA advisory AA23-325A on LockBit 3.0 exploitation.

## Sources

1. [Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967 (CTX579459)](https://support.citrix.com/s/article/CTX579459-netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967)
2. [NetScaler — CVE-2023-4966: Critical security update now available](https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/)
3. [NVD — CVE-2023-4966](https://nvd.nist.gov/vuln/detail/CVE-2023-4966)
4. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. [CISA — AA23-325A: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966 Citrix Bleed](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a)
6. [Mandiant (Google Cloud) — Session Hijacking via Citrix NetScaler CVE-2023-4966](https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966)
7. [Searchlight Cyber (Assetnote) — Citrix Bleed: Leaking Session Tokens with CVE-2023-4966](https://www.slcyber.io/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966)

---
Source page: https://erroneo.us/security/briefs/citrix-bleed-netscaler-cve-2023-4966/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt