Article
NetScaler exposed edge: questions to ask your team
What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet.
Read more
Exploited vulnerability
Citrix Bleed (CVE-2023-4966)
CVE-2023-4966
CVE-2023-4966, nicknamed Citrix Bleed, is a flaw in NetScaler ADC and NetScaler Gateway, the Citrix products that give staff remote access.
- On CISA KEV
- CVE ID
- CVE-2023-4966
- CISA KEV
- Listed
- Affected product
- NetScaler ADC and NetScaler Gateway
- Exploited
- Yes
- Published
- October 2023
In short
CVE-2023-4966, nicknamed Citrix Bleed, is a flaw in NetScaler ADC and NetScaler Gateway, the Citrix products that give staff remote access. An outsider with no login can make the device leak memory that contains a valid session cookie. CISA says LockBit 3.0 ransomware affiliates used it.
- CVECVE-2023-4966
- ProductCitrix (Cloud Software Group) NetScaler ADC and NetScaler Gateway
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade to a fixed build · End existing sessions
What it allows
An attacker with no account sends a crafted web request and the appliance returns part of its memory. That memory holds a valid session cookie. CISA says the actor can then open a session as the real user without a password or a multifactor code, harvest credentials, move sideways and reach data.
Who is affected
Per the vendor, only when the appliance is set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Affected: 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19, 13.1-FIPS before 13.1-37.164, and 12.1-FIPS and 12.1-NDcPP before 12.1-55.300. Version 12.1 is end of life and vulnerable. The bulletin covers customer-managed products only.
The vendor published its bulletin on 10 October 2023 and said exploits on unmitigated appliances had been observed. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 18 October 2023, and the KEV entry flags known use in ransomware campaigns.
In a joint advisory (AA23-325A, 21 November 2023), CISA, the FBI, MS-ISAC and the Australian Signals Directorate's ACSC said exploitation was seen as early as August 2023 and that LockBit 3.0 ransomware affiliates used it to get in. The advisory notes that multifactor authentication does not help once the attacker holds a stolen session.
Who exploits it
What to do
-
Upgrade to a fixed build
The vendor names 14.1-8.50, 13.1-49.15, 13.0-92.19, 13.1-FIPS 13.1-37.164 and 12.1-FIPS or NDcPP 12.1-55.300, or later. Replace 12.1 appliances, which are end of life.
-
End existing sessions
CISA's KEV entry says to kill all active and persistent sessions after mitigation, because a stolen cookie can outlive the patch.
-
Isolate until patched
CISA advises isolating NetScaler ADC and Gateway appliances for testing until patching is ready and deployable.
-
Hunt for hijacked sessions
Per the advisory, check whether users log in from places unusual for your staff, or from two or more public IP addresses at once, and rotate credentials of identities used through the appliance.
-
Segment and restrict remote tools
Limit RDP and allow only approved remote access software, as the advisory recommends, so a hijacked session cannot spread far.
Questions
What is Citrix Bleed?
Citrix Bleed is the nickname for CVE-2023-4966, a flaw in NetScaler ADC and Gateway. A crafted web request makes the appliance return part of its memory, which holds a valid session cookie that an attacker can reuse.
Does MFA protect against Citrix Bleed?
Not once a session is stolen. CISA says the actor can open a session as the real user without a password or multifactor code, and the advisory notes MFA does not help once the attacker holds a stolen session.
How do I defend against Citrix Bleed?
Upgrade to a fixed build such as 14.1-8.50 or 13.1-49.15, then kill all active and persistent sessions, because a stolen cookie can outlive the patch. Also check for logins from unusual places and rotate credentials.
Who exploited Citrix Bleed?
CISA, the FBI, MS-ISAC and ACSC say LockBit 3.0 ransomware affiliates used it to get in, with exploitation seen as early as August 2023. CISA added it to its Known Exploited Vulnerabilities catalog on 18 October 2023.
In our research
- NetScaler exposed edge: questions to ask your team October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident October 2026
- Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
- Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
- Critical RCE Alarm on Citrix ADC and Citrix Gateway December 2022
Sources
- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967 Citrix
- CVE-2023-4966 record NIST NVD
- #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A) CISA, FBI, MS-ISAC, ASD's ACSC
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.