CVE-2023-4966 (CitrixBleed): NetScaler session-token leak that bypasses MFA
The short version: CitrixBleed (CVE-2023-4966) is a memory-disclosure flaw in NetScaler ADC and NetScaler Gateway. On paper it "only" leaks information — but what it leaks is valid session tokens, and an attacker who replays them steps straight into an authenticated session without a password and without MFA. It was exploited at scale, including by ransomware crews. Patching is necessary but not sufficient: you also have to kill the sessions that already leaked. Steady hands — patch and terminate sessions.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (Citrix, CNA) | 9.4 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| EPSS | ~99.99% · 99.99th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2023-11-08 |
| Known exploited? | Yes — mass exploitation, including ransomware operators |
| Vulnerability type | CWE-119 memory buffer over-read → sensitive information disclosure (session-token leak) → session hijack / MFA bypass |
| Requires authenticated session? | No — pre-authentication |
| Affected | NetScaler ADC & Gateway configured as a Gateway or AAA virtual server: 12.1 (now EOL), 13.0 < 92.19, 13.1 < 49.15, 14.1 < 8.50, and FIPS/NDcPP builds |
| Fixed in | 14.1-8.50 · 13.1-49.15 · 13.0-92.19 · 13.1-FIPS 37.164 · 12.1-FIPS/NDcPP 55.300 (12.1 non-FIPS is EOL — upgrade) |
What you need to know
CitrixBleed is an out-of-bounds memory read. By sending a crafted request to a NetScaler appliance configured as a Gateway or AAA virtual server, an unauthenticated attacker gets back chunks of the appliance's memory — and those chunks contain live session tokens from legitimate users.
That's the whole game. The attacker doesn't need to crack anything. They lift a valid token and replay it, and the appliance treats them as the already-authenticated user. Multi-factor authentication doesn't help — MFA is enforced when a session is established, and the attacker is stepping into a session that's already past that gate.
This is why the practical severity outruns the base score, and it's a clean example of a gap worth understanding:
- NVD scores it 7.5 (High) because, mechanically, it's "only" confidentiality — an information leak.
- Citrix scores it 9.4 (Critical) and the real world agreed: it became one of the most heavily exploited flaws of its year, a favorite initial-access vector for ransomware groups against large enterprises.
How serious we see it
High — in practice, not on paper.
The 7.5 is technically defensible and practically misleading. When the "information" being disclosed is a key that unlocks an authenticated, MFA-protected session on an internet-facing access gateway, an information-disclosure bug behaves like a full authentication bypass. We rate it by what it does, not by which CVSS metric box it lands in.
The bounded, reassuring part: it affects specific NetScaler versions in a specific configuration, the fixes are published, and exposure is quick to determine. The catch — see below — is that fixing the flaw doesn't undo the leak that already happened.
Recommendations
Straight from Citrix's bulletin (CTX579459) and CISA:
- Patch now. Upgrade to 14.1-8.50 / 13.1-49.15 / 13.0-92.19 (or the matching FIPS/NDcPP builds) or later. NetScaler 12.1 is End-of-Life — migrate off it.
- Terminate all active sessions — this is the step people miss. After upgrading, run Citrix's guidance to kill existing ICA and PCoIP sessions (
kill icaconnection -all,kill pcoipConnection -all). Tokens that leaked before you patched still work until those sessions are cleared. - Hunt for prior use. Review authentication and session logs for anomalous or impossible-travel sessions, and for reused tokens from unexpected IPs.
- If you find evidence of compromise, respond. Rotate credentials and secrets, and investigate for lateral movement — this bug was routinely step one of a ransomware intrusion.
- Confirm your exposure first. Verify whether you run an internet-facing NetScaler Gateway/AAA vServer, and which build.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing NetScaler Gateway interfaces, fingerprints the build, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like CitrixBleed — pushed to the top of your results because it's in KEV and because our severity take reflects the real-world impact, not just the 7.5.
The value of a continuous attacker's-eye view is precisely for flaws like this one, where the CVSS band undersells the danger: you see the exposed appliance ranked by how it actually gets used against you, not by a score that stops at "information disclosure."