CVE-2023-4966
Unauthenticated sensitive information disclosure
At a glance Severity CRITICAL 9.4 Exploitation Known exploited (CISA KEV) · added 2023-10-18 Exploited per ENISA since 2023-10-18 EPSS EPSS 100.00 % · percentile 100 (2026-10-27) State PUBLISHED Published 2023-10-10 Updated 2026-07-31 Assigner Citrix NVD status Analyzed Description Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Citrix CVSS 3.1 CRITICAL 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L NVD · secure@citrix.com (Secondary) CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 12.1 < 12.1-55.300cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* ≥ 12.1 < 12.1-55.300cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.0 < 13.0-92.19cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* ≥ 13.1 < 13.1-37.164cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 13.1 < 13.1-49.15cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* ≥ 14.1 < 14.1-8.50cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.0 < 13.0-92.19cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 13.1 < 13.1-49.15cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* ≥ 14.1 < 14.1-8.50Affected products Product Versions Citrix · NetScaler ADC affected 14.1 < 8.50 ; affected 13.1 < 49.15 ; affected 13.0 < 92.19 ; affected 13.1-FIPS < 37.164 ; affected 12.1-FIPS < 55.300 ; affected 12.1-NDcPP < 55.300 Citrix · NetScaler Gateway affected 14.1 < 8.50 ; affected 13.1 < 49.15 ; affected 13.0 < 92.19
References
Sources
