CVE-2023-4966

Critical9.4 Published on Oct 10, 2023

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Oct 18, 2023
US federal agencies must remediate it by Nov 8, 2023 (BOD 22-01)
First attack observed 6 days after disclosure
Confirmed by sensors, not only by reports
Used in ransomware campaigns

Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026

CVSS score9.4 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness type (CWE)CWE-119

Vendorscitrix

Affected products

Vendors	Product	Versions
citrix	netscaler application delivery controller	< 12.1-55.300
citrix	netscaler gateway	< 13.0-92.19

Vulnerabilities

BeyondTrust Remote Support Zero-Day Exploited Against Hosted and Self-Hosted Appliances

BeyondTrust Remote Support zero-day exploited in hosted and self-hosted appliances, enabling file operations and root access, linked to Armory Castle.

Oct 16, 202614:40 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database