CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2023-4966

CVSS 9.4v3.1pub. 2023-10-10upd. 2025-10-24

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Citrix Netscaler Application Delivery Controller
APP
Citrix
12.1 – 12.1-55.300 (bez)13.0 – 13.0-92.19 (bez)13.1 – 13.1-37.164 (bez)13.1 – 13.1-49.15 (bez)14.1 – 14.1-8.50 (bez)
Citrix Netscaler Gateway
APP
Citrix
13.0 – 13.0-92.19 (bez)13.1 – 13.1-49.15 (bez)14.1 – 14.1-8.50 (bez)

CISA KEV — detailsi

Vendori: Citrix ↗
Producti: NetScaler ADC and NetScaler Gateway
Added to KEVi: October 18, 2023
Remediation deadline (US Federal)i: November 8, 2023(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory Citrix↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.

CISA descriptioni

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

🔴