---
id: "CVE-2023-4966"
kind: "vulnerability"
aliases: ["CVE-2023-4966"]
title: "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual\u2026"
severity: "critical"
cvss: 9.4
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Citrix NetScaler ADC and NetScaler Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["12.1-55.300"], "affected": ">= 12.1, < 12.1-55.300", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.0-92.19"], "affected": ">= 13.0, < 13.0-92.19", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.164"], "affected": ">= 13.1, < 13.1-37.164", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-49.15"], "affected": ">= 13.1, < 13.1-49.15", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-8.50"], "affected": ">= 14.1, < 14.1-8.50", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.0-92.19"], "affected": ">= 13.0, < 13.0-92.19", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-49.15"], "affected": ">= 13.1, < 13.1-49.15", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-8.50"], "affected": ">= 14.1, < 14.1-8.50", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix", "exploited", "gateway", "netscaler", "ransomware", "self-hosted", "vendor", "vpn"]
not_affected_if: ["no-aaa-vserver", "not-gateway-config"]
published_at: "2023-10-10T14:15:10+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4966", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual…

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow when configured as a Gateway or AAA virtual server, leaking sensitive information from memory. Attackers can steal session tokens and bypass authentication, and the flaw is actively exploited in the wild per CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix NetScaler ADC and NetScaler Gateway affected ? fixed ?
- vendor:citrix netscaler application delivery controller affected >= 12.1, < 12.1-55.300 fixed 12.1-55.300
- vendor:citrix netscaler application delivery controller affected >= 13.0, < 13.0-92.19 fixed 13.0-92.19
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-37.164 fixed 13.1-37.164
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-49.15 fixed 13.1-49.15
- vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-8.50 fixed 14.1-8.50
- vendor:citrix netscaler gateway affected >= 13.0, < 13.0-92.19 fixed 13.0-92.19
- vendor:citrix netscaler gateway affected >= 13.1, < 13.1-49.15 fixed 13.1-49.15
- vendor:citrix netscaler gateway affected >= 14.1, < 14.1-8.50 fixed 14.1-8.50

## How to check

Check whether the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; sources do not give a specific command.

## Fix

Apply the Citrix mitigations and kill all active and persistent sessions per the vendor advisory at https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/, or discontinue use of the product if mitigations are unavailable.
Upgrade to the fixed NetScaler build named in the Citrix advisory (version not stated in sources).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4966
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-4966

## From the sources

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CISA required action: Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_