Citrix Bleed — NetScaler ADC and Gateway Sensitive Information Disclosure
A buffer-overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway allows attackers to harvest valid session tokens from device memory, hijacking authenticated sessions and bypassing MFA entirely. Widely known as "Citrix Bleed."
- Vendor
- Citrix
- Product
- NetScaler ADC and NetScaler Gateway
- CVSS
- 9.4
- EPSS (exploit probability)
- 100.0%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2023-4966 being exploited?
Yes. CISA added CVE-2023-4966 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 100.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2023-4966 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2023-4966, dubbed “Citrix Bleed” by researchers, is a sensitive-information-disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a gateway (VPN, ICA proxy, CVPN, RDP proxy) or AAA virtual server. A buffer-overflow condition lets a remote, unauthenticated attacker retrieve session tokens directly from device memory.
Because the leaked tokens belong to already-authenticated sessions, attackers who capture them can hijack a legitimate user’s session without ever needing a password or a second factor — completely bypassing MFA. The flaw was added to CISA’s KEV catalog in November 2023 after ransomware affiliates, including LockBit-linked actors, were observed exploiting it against large enterprises and at least one major financial-sector organization.
Why it mattered
Citrix Bleed proved that even a fully MFA-protected environment can be compromised if a stolen session token is valid. Citrix urged admins not just to patch but to kill all active ICA and PCoIP sessions post-patch, since old sessions captured before the fix remained valid and exploitable.
Full technical detail and patched build numbers are in Citrix’s own security bulletin and the NVD entry above.
Other Citrix NetScaler ADC and NetScaler Gateway CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-107406 Memory overflow in Citrix NetScaler ADC and Gateway SAML handlingwrite-up | [ CRITICAL ] | 9.5 | 1.9% | — |
| CVE-2026-88779 Citrix NetScaler Memory Buffer Flaw Enables Denial-of-Service Attackswrite-up | [ HIGH ] | 7.5 | 11.4% | |
| CVE-2026-88772 Citrix NetScaler ADC/Gateway RCE via Memory Buffer Mishandlingwrite-up | [ HIGH ] | — | 76.6% | |
| CVE-2026-88771 Citrix NetScaler ADC/Gateway Unauthenticated RCE via Input Validation Flawwrite-up | [ HIGH ] | — | 81.9% | |
| CVE-2026-19490 Critical authentication bypass in Citrix NetScaler ADC and Gatewaywrite-up | [ CRITICAL ] | 9.3 | 33.3% | |
| CVE-2026-8452 Citrix NetScaler ADC and Gateway Memory Buffer Overflowwrite-up | [ CRITICAL ] | 9.8 | 1.0% | |
| CVE-2025-5777 Citrix Bleed 2 — NetScaler ADC/Gateway memory-disclosure leaking session tokensransomware usewrite-up | [ HIGH ] | 7.5 | 100.0% | |
| CVE-2025-6543 Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 10.4% |
