CVE-2023-4966

Think of this like a hotel key-card system with a glitch that lets someone peek at a guest's room key code just by asking the front desk the right way — no ID needed. An attacker can pull a live login session straight out of the device's memory and use it to walk into your network as if they were an already-logged-in employee, skipping passwords and even multi-factor checks entirely.

This matters to you if you run NetScaler ADC or NetScaler Gateway (formerly Citrix ADC/Gateway) as a remote-access gateway for employees, contractors, or VPN users, or as an AAA authentication server. If your device is only used for simple load-balancing and not configured as a gateway or AAA virtual server, this specific flaw does not apply to you.

Attackers are already exploiting this flaw in the wild, including as part of ransomware campaigns, so this is an active, confirmed threat rather than a theoretical one. CISA has ordered US federal agencies to remediate it, underscoring how dangerous it's considered. Treat this as an emergency: patch and kill existing sessions without delay.

Confirm exposure by checking whether the NetScaler device has a VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server configured — this is a precondition for exploitation, not a default-config risk. Identify the current build and upgrade to a fixed version: NetScaler ADC/Gateway 13.1-49.15+, 13.0-92.19+, 12.1-55.300+ (for 12.1, now EOL — migrate), or 13.1-FIPS/NDcPP 13.1-37.164+. There is no effective workaround short of disabling the affected gateway functionality, since the flaw is exploitable pre-authentication over the network. Critically, patching alone is insufficient: because this attack steals valid session tokens, you must terminate all active and persistent ICA and PCoIP sessions after upgrading (per Citrix's CTX579459 guidance), or stolen sessions from before the patch remain usable. CISA KEV required remediation by 2023-11-08; treat any instance still unpatched as compromised and investigate for unauthorized session activity, webshells, or lateral movement. Monitor authentication logs for anomalous session reuse and consider forcing re-authentication of all users.

CVSS 9.4 (Critical), AV:N/AC:L/PR:N/UI:N — network-exploitable, no privileges or interaction needed, high confidentiality and integrity impact. Weakness is a buffer-related out-of-bounds read (CWE-119) causing unauthenticated disclosure of session-token material from device memory. Confirmed in CISA's Known Exploited Vulnerabilities catalog (added 2023-10-18) with documented ransomware use (dubbed 'CitrixBleed'); a public exploit is available and EPSS places likelihood at the highest percentile with a rising trend, though exploitation is already confirmed so this prediction is secondary to the KEV listing. Exploit maturity: weaponized and actively used by threat actors for session hijacking leading to ransomware deployment.