ClosedPatched
Day · Nov 21, 2023
Citrix Bleed: NetScaler session token leak (CVE-2023-4966)
Citrix NetScaler ADC and NetScaler Gateway
Updates on Nov 21, 2023
CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A)
Source
Summary
A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).
Read the full incident →Advisories6
- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967Citrix · Oct 10, 2023
- CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler GatewayNetScaler
- #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)CISA · Nov 21, 2023
- Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix BleedCISA
- NVD: CVE-2023-4966NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Oct 18, 2023
