---
title: "CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability"
url: https://erroneo.us/security/cve/CVE-2023-4966/
description: "CVE-2023-4966 (Citrix NetScaler ADC and NetScaler Gateway): Exploited in the wild (CISA KEV). Sensitive information disclosure in NetScaler ADC and…"
type: vulnerability-record
section: "Security Digest"
date_published: 2023-10-10
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2023-4966"
kev: true
cvss: 9.4
epss: 0.99999
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2023-4966: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

**Signal:** Exploited: patch now if you run it. CISA has confirmed exploitation in the wild. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Yes, if you run Citrix NetScaler ADC and NetScaler Gateway. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2023-10-18, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2023-11-08 ; treat that as the outer limit, not the target. CISA also lists it as known to be used in ransomware campaigns .
- EPSS 100.0% , percentile 100.0: FIRST’s model estimates a 100.0% chance of exploitation activity in the next 30 days, higher than 100.0% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Act now. Citrix Bleed: NetScaler Gateway Leaks Session Tokens — If a NetScaler configured as a Gateway or AAA server is still on a vulnerable build, assume it is being probed and patch, kill every session, and hunt; patching alone does not evict an attacker holding a stolen session.

## What it is

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

## Affected products (CVE record)

- Citrix NetScaler ADC: 14.1 < 8.50, 13.1 < 49.15, 13.0 < 92.19, 13.1-FIPS < 37.164, 12.1-FIPS < 55.300, 12.1-NDcPP < 55.300
- Citrix NetScaler Gateway: 14.1 < 8.50, 13.1 < 49.15, 13.0 < 92.19

## Severity

- Citrix CVSS 3.1: 9.4 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L`

## Exploitation

- CISA KEV: added 2023-10-18; federal due date 2023-11-08. Known ransomware use: Known.
- CISA required action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 100.00% probability of exploitation activity in the next 30 days; percentile 100.0.

## Sources

- [Listed in CISA KEV notes (netscaler.com)](https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/)
- [Listed in CISA KEV notes (support.citrix.com)](https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967)
- [CVE.org record CVE-2023-4966](https://www.cve.org/CVERecord?id=CVE-2023-4966)
- [NVD entry CVE-2023-4966](https://nvd.nist.gov/vuln/detail/CVE-2023-4966)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966)
- [support.citrix.com](https://support.citrix.com/article/CTX579459)
- [packetstormsecurity.com](http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html)

---
Source page: https://erroneo.us/security/cve/CVE-2023-4966/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt