Citrix Bleed: NetScaler session token leak (CVE-2023-4966)
Citrix NetScaler ADC and NetScaler Gateway
A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).
Why this severity: CVSS 9.4 (Citrix), zero-day, actively exploited (CISA KEV), known ransomware use
- Started
- Oct 10, 2023
- Closed
- Nov 21, 2023
Affected
- NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory
Fixed in
- 14.1-8.50
- 13.1-49.15
- 13.0-92.19
- FIPS/NDcPP builds: see vendor advisory
Updates by day6
▸Dec 18, 2023
Link #Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers
Source
▸Nov 21, 2023
Link #CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A)
Source
▸Oct 23, 2023
Link #Citrix issues additional mitigation guidance
Source
▸Oct 18, 2023
Link #CISA adds CVE-2023-4966 to the KEV catalog
▸Oct 17, 2023
Link #Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching
Source
▸Oct 10, 2023
Link #Citrix publishes bulletin CTX579459 and fixed builds
Source
Advisories6
- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967Citrix · Oct 10, 2023
- CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler GatewayNetScaler
- #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)CISA · Nov 21, 2023
- Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix BleedCISA
- NVD: CVE-2023-4966NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Oct 18, 2023
News & write-ups1
Notes & caveats
startedAt is the vendor disclosure; Mandiant saw exploitation from late August 2023. Patching alone did not end hijacked sessions.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
