Sessionwright

Known exploitedCitrixBleed

CVE-2023-4966: what NetScaler® admins need to do

CVE-2023-4966 (information disclosure) affects NetScaler ADC and Gateway. In CISA KEV since 2023-10-18. Fixed in 14.1-8.50 / 13.1-49.15. Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2023-4966Request an emergency upgrade

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1-8.50 / 13.1-49.15First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2023-10-18, federal due date 2023-11-08. Known ransomware use: Known.
Forensic triage
No forensic triage flag on this KEV entry.
CVSS
9.4 (CVSS v3.1, vendor score in CTX579459)
Preconditions
Configured as Gateway or AAA virtual server
Session kill advised
Yes, per CTX579459, after every node is upgraded.

Fixed builds from the Citrix® security bulletin CTX579459

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.114.1-8.5014.1-73.46
NetScaler 13.1Past end of maintenance13.1-49.1513.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.164 FIPS13.1-37.283 FIPS
NetScaler 13.0End of life: migrate13.0-92.19
NetScaler 12.1 FIPS/NDcPP12.1-55.300 FIPS12.1-55.300 FIPS

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler ADC and NetScaler Gateway).

Our advisory data, taken from CTX579459, summarises it as: Session token memory leak. Vulnerability class: sensitive information disclosure (memory leak) (CWE-119). Precondition: Configured as Gateway or AAA virtual server.

For the full description, read the CVE.org record for CVE-2023-4966 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway or AAA virtual server. Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2023-4966 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2023-4966 highlighted

How to patch

  1. Choose the target build: at least 14.1-8.50 on 14.1 or 13.1-49.15 on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin
kill aaa session -all
kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
clear lb persistentSessions

Run session kills only after every HA or cluster node is on the fixed build.

Additional steps from CISA, CERTs and researchers

community guidance
  • Rotate credentials of users whose sessions may have been hijacked

Run session kills only after every HA or cluster node is on the fixed build.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • Session hijack hunting

    • Same AAA session used from multiple client IPs (ns.log / SIEM)
    • CISA AA23-325A LockBit IoCs: AnyDesk/Splashtop, 123.ps1, adobelib.dll

    Tools: CISA AA23-325A

    Source: CISA AA23-325A; Tenable

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX579459 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date

Related CVEs

  • CVE-2023-4967Denial of serviceNot in KEVSame bulletin (CTX579459)
Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2023-4966: questions

Which NetScaler builds fix CVE-2023-4966?

Vendor bulletin CTX579459 fixes CVE-2023-4966 in 14.1-8.50 (NetScaler 14.1), 13.1-49.15 (NetScaler 13.1), 13.1-37.164 FIPS (NetScaler 13.1 FIPS/NDcPP), 13.0-92.19 (NetScaler 13.0, now end of life) and 12.1-55.300 FIPS (NetScaler 12.1 FIPS/NDcPP). As of 2026-10-15, the current safe builds, which also include later fixes, are 14.1-73.46, 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2023-4966 exploited in the wild?

Yes. CISA added CVE-2023-4966 to the Known Exploited Vulnerabilities catalog on 2023-10-18, with a federal remediation due date of 2023-11-08. Known ransomware campaign use: Known.

Do I need to kill sessions after patching CVE-2023-4966?

Yes. CTX579459 lists kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all and clear lb persistentSessions. Run them only after every node in the HA pair or cluster is on the fixed build.

Check every appliance, not just one, for CVE-2023-4966

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment