Detections
Analytics

CVE-2023-4966

high

Description

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

References

http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html

https://www.itsecurityguru.org/2026/07/09/citrixbleed-2-exploited-in-repeatable-attack-chain-culminating-in-dragonforce-ransomware-researchers-find/?utm_source=rss&utm_medium=rss&utm_campaign=citrixbleed-2-exploited-in-repeatable-attack-chain-culminating-in-dragonforce-ransomware-researchers-find

https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware

https://www.darkreading.com/vulnerabilities-threats/citrixbleed-ing-again-netscaler-vulnerability-under-attack

https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/files/2026/03/2025YiR-report.pdf

https://securityaffairs.com/190197/security/u-s-cisa-adds-a-flaw-in-citrix-netscaler-to-its-known-exploited-vulnerabilities-catalog.html

https://securityaffairs.com/190131/hacking/urgent-alert-netscaler-bug-cve-2026-3055-probed-by-attackers-could-leak-sensitive-data.html

https://thehackernews.com/2026/03/citrix-netscaler-under-active-recon-for.html

https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-netscaler-flaws-as-soon-as-possible/

https://thehackernews.com/2026/03/citrix-urges-patching-critical.html

https://securityaffairs.com/189908/security/citrix-netscaler-critical-flaw-could-leak-data-update-now.html

https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/

https://www.securityweek.com/cisco-ise-citrixbleed-2-vulnerabilities-exploited-as-zero-days-amazon/

https://www.darkreading.com/vulnerabilities-threats/citrixbleed-2-cisco-zero-day-bugs

https://www.theregister.com/2025/08/28/thousands_of_citrix_netscaler_boxes/

https://www.darkreading.com/vulnerabilities-threats/citrix-zero-day-under-active-attack

https://cyberscoop.com/citrix-netscaler-zero-day-exploited-august-2025/

https://www.securityweek.com/citrixbleed-2-flaw-poses-unacceptable-risk-cisa/

https://www.databreachtoday.com/attackers-now-scanning-extensively-for-citrix-bleed-2-a-28959

https://cyberscoop.com/citrixbleed2-exploits-spread/

https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/

https://thehackernews.com/2025/07/cisa-adds-citrix-netscaler-cve-2025.html

https://securityaffairs.com/179813/hacking/u-s-cisa-adds-citrix-netscaler-adc-and-gateway-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/

https://arstechnica.com/security/2025/07/critical-citrixbleed-2-vulnerability-has-been-under-active-exploit-for-weeks/

https://www.securityweek.com/exploits-technical-details-released-for-citrixbleed2-vulnerability/

https://www.databreachtoday.com/attackers-actively-exploit-citrix-bleed-2-vulnerability-a-28907

https://www.bleepingcomputer.com/news/security/public-exploits-released-for-citrixbleed-2-netscaler-flaw-patch-now/

https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

https://www.securityweek.com/thousands-of-citrix-netscaler-instances-unpatched-against-exploited-vulnerabilities/

https://www.helpnetsecurity.com/2025/06/30/citrixbleed-2-might-be-actively-exploited-cve-2025-5777/

https://www.securityweek.com/evidence-suggests-exploitation-of-citrixbleed-2-vulnerability/

https://www.infosecurity-magazine.com/news/citrixbleed-2-vulnerability/

https://www.bleepingcomputer.com/news/security/citrix-bleed-2-flaw-now-believed-to-be-exploited-in-attacks/

https://securityaffairs.com/179339/hacking/citrixbleed-2-the-nightmare-that-echoes-the-citrixbleed-flaw-in-netscaler-devices.html

https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/

https://www.theregister.com/2025/06/25/citrix_netscaler_critical_bug_exploited/

https://www.bleepingcomputer.com/news/security/new-citrixbleed-2-netscaler-flaw-let-hackers-hijack-sessions/

https://thehackernews.com/2025/06/citrix-bleed-2-flaw-enables-token-theft.html

https://cyberscoop.com/citrix-zero-day-netscaler/

https://www.theregister.com/2025/06/24/critical_citrix_bug_citrixbleed/

https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206

https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/

https://thehackernews.com/2025/04/critical-ivanti-flaw-actively-exploited.html

https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability

https://news.sophos.com/en-us/2025/04/02/2025-sophos-active-adversary-report/

https://www.securityweek.com/citrix-cisco-fortinet-zero-days-among-2023s-most-exploited-vulnerabilities/

https://www.bleepingcomputer.com/news/security/embargo-ransomware-escalates-attacks-to-cloud-environments/

https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/

https://services.google.com/fh/files/misc/m-trends-2024.pdf

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-attacks-exploits

https://www.secureworks.com/blog/lockbit-in-action

https://blog.talosintelligence.com/talos-ir-quarterly-report-q4-2023/

https://therecord.media/hhs-warns-of-citrix-bleed-bug

https://cyberplace.social/@GossiTheDog/111502145876827515

https://cybernews.com/news/yanfeng-ransomware-attack-claimed-qilin/

https://www.bleepingcomputer.com/news/security/recently-patched-citrix-netscaler-bug-exploited-as-zero-day-since-august/

https://www.theregister.com/2025/08/12/major_outage_at_pennsylvania_attorney/

https://isc.sans.edu/diary/rss/30498

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-exploits-citrix-bleed-in-attacks-10k-servers-exposed/

https://cyberplace.social/@GossiTheDog/111408758925049114

https://www.theregister.com/2023/10/31/mass_exploitation_citrix_bleed/

https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2023-4966

https://www.tenable.com/blog/vulnerability-prioritization-attacker-mapping-severity-exploitation-risk

https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution

https://www.tenable.com/blog/cve-2025-5777-cve-2025-6543-frequently-asked-questions-about-citrixbleed-2

https://www.tenable.com/blog/verizon-2025-dbir-tenable-research-collaboration

https://www.tenable.com/blog/from-bugs-to-breaches-25-significant-cves-as-mitre-cve-turns-25

https://www.tenable.com/blog/cve-2023-6548-cve-2023-6549-zero-day-vulnerabilities-netscaler-adc-gateway-exploited

https://www.tenable.com/blog/cve-2023-4966-citrixbleed-invalidate-sessions-to-prevent-compromise

https://www.tenable.com/blog/cve-2023-4966-citrix-netscaler-adc-and-netscaler-gateway-information-disclosure-exploited-in

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966

https://support.citrix.com/article/CTX579459

Details

Source: Mitre, NVD

Published: 2023-10-10

Updated: 2026-07-31

Named Vulnerability: CitrixBleedNamed Vulnerability: Citrix BleedKnown Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.99999

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Concern