# Citrix Bleed: NetScaler session token leak (CVE-2023-4966) · pwn.watch > A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users). Page: https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966 · generated 2026-10-22T20:45:43.249Z ## Status - Severity: critical · status: closed · patch: patched - Product: Citrix NetScaler ADC and NetScaler Gateway - Started: 2023-10-10 · closed: 2023-11-21 - CVEs: CVE-2023-4966 - Affected: NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory - Fixed in: 14.1-8.50; 13.1-49.15; 13.0-92.19; FIPS/NDcPP builds: see vendor advisory ## Follow this incident - RSS (one item per update): https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966/feed.xml - JSON Feed: https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json - This file: https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966/llms.txt ## Updates (newest first) - 2023-12-18: Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers (https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix) - 2023-11-21: CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A) (https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a) - 2023-10-23: Citrix issues additional mitigation guidance (https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf) - 2023-10-18: CISA adds CVE-2023-4966 to the KEV catalog - 2023-10-17: Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching (https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966) - 2023-10-10: Citrix publishes bulletin CTX579459 and fixed builds (https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-secu.html) ## Fix brief # Security brief: Citrix Bleed: NetScaler session token leak (CVE-2023-4966) Source: https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966 · status: closed (closed Nov 21, 2023) · severity: critical · updated Dec 18, 2023 ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users). Severity detail: CVSS 9.4 (Citrix), zero-day, actively exploited (CISA KEV), known ransomware use - Product: Citrix NetScaler ADC and NetScaler Gateway - CVE / advisory ids: CVE-2023-4966 ## Affected versions - NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 14.1-8.50 - 13.1-49.15 - 13.0-92.19 - FIPS/NDcPP builds: see vendor advisory After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Dec 18, 2023: Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers - Nov 21, 2023: CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A) - Oct 23, 2023: Citrix issues additional mitigation guidance - Oct 18, 2023: CISA adds CVE-2023-4966 to the KEV catalog - Oct 17, 2023: Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching - Oct 10, 2023: Citrix publishes bulletin CTX579459 and fixed builds ## Advisories - [NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967](https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-secu.html) (Citrix) - [CVE-2023-4966: Critical security update now available for NetScaler ADC and NetScaler Gateway](https://www.netscaler.com/blogs/2023-10/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway) (NetScaler) - [#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (AA23-325A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a) (CISA) - [Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix Bleed](https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed) (CISA) - [NVD: CVE-2023-4966](https://nvd.nist.gov/vuln/detail/CVE-2023-4966) (NVD) - [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA) ## Write-ups & news - [Remediation for Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)](https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966) ## Caveats startedAt is the vendor disclosure; Mandiant saw exploitation from late August 2023. Patching alone did not end hijacked sessions. --- Machine-readable: https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.