Servers and applications

CVE-2023-4966

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 18 Oct 2023.

Severity: High 7.5
Published: 10 Oct 2023
Last changed: 31 Jul 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 12.1-55.300, 13.0-92.19, 13.1-37.164, 13.1-49.15, 14.1-8.50
Sources: NVD

Affected software

Software	Affected versions
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_application_delivery_controller`	From 12.1 before 12.1-55.300 From 13.0 before 13.0-92.19 From 13.1 before 13.1-37.164 From 13.1 before 13.1-49.15 From 14.1 before 14.1-8.50
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_gateway`	From 13.0 before 13.0-92.19 From 13.1 before 13.1-49.15 From 14.1 before 14.1-8.50

Known exploited

CISA name: Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Required action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
Due for US agencies: 8 Nov 2023
Used in ransomware: Yes, known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2023-4966
CVE.org https://www.cve.org/CVERecord?id=CVE-2023-4966