Citrix Netscaler ADC and Netscaler Gateway [CVE-2023-4966] – October 26, 2023

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway have a zero-day, critical information disclosure vulnerability [CVE-2023-4966]. Citrix NetScaler ADC and NetScaler Gateway have a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

This vulnerability’s notoriety is driven by its high severity in popular network appliances with reports dating back to August of active exploitation that enabled session and account hijacking.

See the resource center.

Status

The Bitsight Research team has been researching multiple approaches to developing both suspected and confirmed detection capabilities.