Critical 9.4Known exploited (CISA KEV)Published Oct 10, 2023

CVE-2023-4966Unauthenticated sensitive information disclosure

Updated under an hour ago (2026-10-19 05:50 UTC)

Does this affect you?

It affects Citrix NetScaler ADC and 2 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Oct 18, 2023; federal agencies had to remediate by Nov 8, 2023, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Citrix NetScaler ADC

Exploited in the last 30 days

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

CVSS: 9.4 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness (CWE): CWE-119
Known exploited: Added to CISA KEV Oct 18, 2023; federal remediation due Nov 8, 2023; known ransomware useApply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 100.00% (percentile 100)
Assigned by: Citrix
NVD analysis: Analyzed
Record last updated: Jul 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Citrix NetScaler ADC citrix:netscaler_adc (from the name)	14.1 builds before 8.50; 13.1 builds before 49.15; 13.0 builds before 92.19; 13.1-FIPS builds before 37.164; 12.1-FIPS builds before 55.300; 12.1-NDcPP builds before 55.300	CNA record
Citrix NetScaler Gateway citrix:netscaler_gateway (from the name)	14.1 builds before 8.50; 13.1 builds before 49.15; 13.0 builds before 92.19	CNA record
citrix netscaler_application_delivery_controller citrix:netscaler_application_delivery_controller	from 12.1 before 12.1-55.300; from 12.1 before 12.1-55.300; from 13.0 before 13.0-92.19; from 13.1 before 13.1-37.164; from 13.1 before 13.1-49.15; from 14.1 before 14.1-8.50	NVD
citrix netscaler_gateway citrix:netscaler_gateway	from 13.0 before 13.0-92.19; from 13.1 before 13.1-49.15; from 14.1 before 14.1-8.50	NVD

References

https://support.citrix.com/article/CTX579459vendor-advisory
http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.htmlthird-party-advisory, vdb-entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.