Vulnary
← back to the feed
Critical· 9.4actively exploitedofficial fix available

CVE-2023-4966

A critical flaw in Citrix NetScaler ADC and Gateway lets attackers read sensitive data when the devices are set up as VPN or gateway services. The vulnerability can expose confidential information without authentication and requires no user interaction.

publishedOct 10, 2023
last modifiedJul 31, 2026
sourcesNVD · CISA-KEV
severity · cvss
9.4
critical · how bad it is
exploitation · epss
100%
100th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 30, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Citrix NetScaler Application Delivery Controller and NetScaler Gateway appliances configured as VPN virtual servers, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers. Typical users are enterprises that deploy NetScaler for secure remote access.

02

Real-world impact

An attacker could read confidential data such as credentials or configuration details from the affected NetScaler devices, potentially compromising network security.

03

Why this severity

The CVSS score of 9.4 reflects that the flaw is network‑accessible, requires no privileges, and can lead to full confidentiality loss, with a high impact on integrity and a moderate impact on availability.

04

What to do about it

official fix available
recommended steps
  1. 01Review the vendor’s mitigation guidance at https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/
  2. 02Apply the mitigations described in the guidance
  3. 03Terminate all active and persistent sessions as instructed

CISA KEV required action

05

Timeline

  1. Oct 10, 2023 · Oct 10, 2023
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Oct 18, 2023 · Oct 18, 2023
    Confirmed exploited (CISA KEV)
    CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
  3. Nov 8, 2023 · Nov 8, 2023
    CISA remediation deadline
    Federal agencies are required to remediate by this date.
  4. Jul 31, 2026 · 6d ago
    Advisory updated
    The NVD record was last revised.
  5. Jul 31, 2026 · 6d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactLow
07

References & advisories

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →