CVE-2023-4966 (Citrix Bleed): NetScaler session hijack

CVE-2023-4966 ("Citrix Bleed") is a buffer-overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated attacker leak device memory — including session tokens that can be replayed to hijack an authenticated session — and it was exploited in the wild, including in ransomware intrusions, before organizations could patch.

CVE-2023-4966 affects Citrix NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. The underlying buffer overflow lets an unauthenticated attacker read beyond the intended buffer and disclose sensitive memory contents, including valid session tokens; replaying a leaked token lets the attacker take over an already-authenticated session without needing credentials or MFA (NVD).

Scoring for this CVE differs by source. NVD's own analysis gives it CVSS v3.1 7.5 (high) — network-reachable, low attack complexity, no privileges or user interaction required, but scoped only to a confidentiality impact with no integrity or availability impact (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Citrix's own (CNA) submission scores it higher, CVSS v3.1 9.4 (critical), reflecting that a hijacked session can also be used to tamper with data and partially affect availability (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) — a CNA-reported figure, not an NVD-confirmed one (NVD).

CISA added CVE-2023-4966 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-10-18, with a required-action due date of 2023-11-08, and records known use in ransomware campaigns (CISA KEV).

Citrix's security bulletin CTX579459 lists the builds above as affected and states there is no workaround — affected appliances must be upgraded to a fixed build — and "strongly urges" customers to install the updates as soon as possible. Citrix separately confirmed that "exploits of CVE-2023-4966 on unmitigated appliances have been observed", and advised investigating devices for signs of prior compromise given reports of session hijacking tied to this flaw (Citrix Security Bulletin CTX579459).

As of 2026-10-20, FIRST scores the probability of exploitation at the top of the EPSS distribution (EPSS 0.9999, 99.997th percentile), consistent with a vulnerability that remains under active scanning years after disclosure (FIRST EPSS).

Because no workaround exists, any NetScaler ADC or Gateway instance on an affected build should be upgraded immediately and, given the documented exploitation, reviewed for signs of prior session hijacking or compromise.

• Unauthenticated buffer overflow in NetScaler ADC/Gateway (Gateway or AAA virtual server roles) discloses memory contents including session tokens, enabling session hijack. — NVD
• NVD CVSS v3.1 base score is 7.5 (high); Citrix's own CNA-submitted score is 9.4 (critical) — a CNA-reported figure, not NVD-confirmed. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2023-10-18, due date 2023-11-08, with known ransomware campaign use. — CISA KEV
• Affected: NetScaler ADC/Gateway 12.1 (FIPS/NDcPP) before 12.1-55.300, 13.0 before 13.0-92.19, 13.1 before 13.1-49.15 (13.1-FIPS before 13.1-37.164), 14.1 before 14.1-8.50; no workaround, patch is the only remediation; exploitation on unmitigated appliances observed. — Citrix Security Bulletin CTX579459
• EPSS score is 0.9999 (99.997th percentile) as of 2026-10-20. — FIRST EPSS