Start with Identity
Subscribe
Identity CVE · Other

CVE-2023-4966Citrix Bleed, session-token leak from NetScaler ADC

critical · CVSS 9.4CISA KEVActively exploited
Product: Citrix NetScaler ADC / GatewayVendor: Cloud Software GroupCWE-119Disclosed: 2023-10-10Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

NetScaler ADC and Gateway (the Citrix ADC/Gateway pair) would over-read a buffer and return memory that contained live session cookies. An unauthenticated caller harvested tokens and replayed them. MFA on the original login did not matter. The session already existed. CISA added CVE-2023-4966 to KEV. Public name: Citrix Bleed. October 2023.

Why it matters

This is session hijacking as a product bug, not a stolen laptop. Identity teams who measure success as "MFA is on" learned that a gateway cookie is a bearer credential. The same lesson shows up later in Pass-the-Passkey and in our infostealer teardown.

What to do

  • Patch ADC/Gateway, then terminate all sessions. A patched box with live leaked cookies is still owned.
  • Hunt for sessions that have no matching interactive login, especially from new ASNs after 10 October 2023.
  • Bind gateway sessions to a device or client where the product allows it. Shorten idle timeouts.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.