CVE-2023-4966

CRITICAL

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

CVSS v3.1 Score

9.4
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Published: 10/10/2023Modified: 6/17/2026

Related Intelligence (1)

CRITICALVulnerability

New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild

Citrix NetScaler appliances have been a constant target for attackers in recent years, most recently through an information leak vulnerability dubbed CitrixBleed 3, the latest in a series of NetScaler memory overreads going back to 2023. This week, Citrix patched yet another CitrixBleed-like vulnerability and there are signs of in-the-wild exploitation already. The new memory overread vulnerabilit

CVE-2026-8451CVE-2023-4966
CSO Online

References (5)

http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.htmlThird Party AdvisoryVDB Entryhttps://support.citrix.com/article/CTX579459Vendor Advisoryhttp://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.htmlThird Party AdvisoryVDB Entryhttps://support.citrix.com/article/CTX579459Vendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966US Government Resource