CVE-2023-4966: Citrix Bleed
Improper Restriction of Memory Buffer: Is CVE-2023-4966 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Confirmed exploited in the wild. Patch this first, regardless of the base score.
public exploits
links to sources — we don’t host codeUnverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.
baseline read
auto · not a community verdict
Real — exploited in the wild
CISA confirms active exploitation. Treat scanner hits as true positives unless your specific version or config is unaffected.
Based on CISA KEV
Confirm or dispute →CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2023-4966)<a href="https://www.truepositive.app/cve/CVE-2023-4966"><img src="https://www.truepositive.app/cve/CVE-2023-4966/badge.svg" alt="TruePositive verdict for CVE-2023-4966"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is Real & exploitable — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
This is real and was heavily used by ransomware gangs (including LockBit). It hits Citrix NetScaler ADC and Gateway. The bug leaks memory that contains valid session tokens. An attacker grabs a token and hijacks a live user session, which also bypasses MFA. No login needed.
Who is affected: NetScaler ADC and Gateway appliances set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, on the vulnerable firmware versions. If your NetScaler only does load balancing and is not set up as a Gateway or AAA server, this specific bug may not apply. Check the config.
Important: patching alone is not enough here. Attackers who already stole session tokens can keep using them after you patch. You must also kill all active sessions.
Commonly flagged by: Nessus, Qualys, Rapid7.
- 0
Upgrade NetScaler to a fixed firmware version (13.1-49.15+, 14.1-8.50+, or the fixed 13.0-92.19 build, and later). Then, because stolen tokens survive a patch, end all active and persistent sessions after upgrading:
kill icaconnection -all,kill rdp connection -all,kill aaa session -all, andclear lb persistentSessions. Then look for signs of session hijack and lateral movement, because this was actively exploited.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-119 · Improper Restriction of Memory Buffer.
- CVE-2017-11882HIGH 7.8KEVEPSS 100%
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
- CVE-2020-0796CRIT 10KEVEPSS 100%
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
- CVE-2014-6332HIGH 8.8KEVEPSS 95%
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted web site, as demonstrated by an array-redimensioning attempt that triggers improper handling of a size value in the SafeArrayDimen function, aka "Windows OLE Automation Array Remote Code Execution Vulnerability."
- CVE-2015-2426HIGH 8.8KEVEPSS 87%
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
- CVE-2009-3459HIGH 8.8KEVEPSS 87%
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
- CVE-2010-3765CRIT 9.8KEVEPSS 83%
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption, as exploited in the wild in October 2010 by the Belmoo malware.