RetrospectiveExploited in the wildCRITICALCISA KEV

Citrix Bleed: NetScaler session token leak exploited as zero-day and by LockBit

An unauthenticated over-read in NetScaler ADC and Gateway leaked post-MFA session cookies. Patching closed the leak but not stolen sessions, so killing all sessions after the upgrade was part of the fix.

Citrix NetScaler ADC and NetScaler GatewayCVE-2023-4966CVSS9.4CWE-119Edge & VPN
Published Oct 22, 2026

Exploited as a zero-day from late August 2023 per Mandiant, confirmed by Citrix on 2023-10-17, and used by LockBit 3.0 affiliates per a CISA-led joint advisory 1,3,4.

Oct 10, 202342 daysNov 21, 2023

What you need to know

  • Affects customer-managed NetScaler ADC and Gateway configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
  • An unauthenticated request can leak appliance memory containing valid session cookies, letting an attacker take over a logged-in session and skip MFA.
  • Exploited as a zero-day since late August 2023, then widely after disclosure, including by LockBit 3.0 affiliates; in CISA KEV since 2023-10-18.
  • Fixed in 14.1-8.50, 13.1-49.15, 13.0-92.19 and the listed FIPS/NDcPP builds; after upgrading, terminate all active and persistent sessions.
  • Hunt ns.log for sessions whose client IP changes mid-session, and for one IP using several accounts in a short window.

What's happening

CVE-2023-4966, known as Citrix Bleed, is an information disclosure flaw in NetScaler ADC and NetScaler Gateway that Citrix rated CWE-119 and fixed on 2023-10-10 1. It is reachable without authentication on appliances set up as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; Citrix-managed cloud services and Citrix-managed Adaptive Authentication were not affected 1. The leaked memory can include a valid session cookie, and replaying it gives the attacker an already-authenticated session, MFA included 5,6.

Mandiant found zero-day exploitation starting in late August 2023, against professional services, technology and government organizations 4. Citrix amended its bulletin on 2023-10-17 to say "Exploits of CVE-2023-4966 on unmitigated appliances have been observed" 1, and CISA added the CVE to KEV on 2023-10-18 2. Mandiant later tracked four distinct uncategorized (UNC) groups using the bug across the Americas, EMEA and APJ 5.

On 2023-11-21, CISA, the FBI, MS-ISAC and ASD's ACSC published a joint advisory on LockBit 3.0 affiliates and other groups exploiting Citrix Bleed 3. The Record reported that the advisory names Boeing Distribution Inc. as a victim where affiliates used the flaw for initial access, and that CISA's Eric Goldstein said both state-sponsored and criminal groups were exploiting it 9. Around 2023-11-14, more than 10,400 internet-facing servers were still unpatched, according to a researcher count reported by BleepingComputer 8.

How it works

Assetnote traced the bug to the nsppe packet engine, specifically the two handlers that return the OpenID Connect discovery document at /oauth/idp/.well-known/openid-configuration and its /oauth/rp/ counterpart 6. Each handler formats a JSON response with snprintf into a fixed 0x20000-byte buffer and then trusts snprintf's return value as the length to send 6. That return value is the length the output would have had, so when the response is too large the appliance sends bytes past the end of the buffer: a classic over-read 6.

The attacker can make the response too large because it embeds the client-supplied HTTP Host value several times 6. The bytes that follow the buffer can hold leftover data, and Assetnote confirmed this included a working NSC_AAAC session cookie 6. Because that cookie is issued only after login and MFA, replaying it lets the attacker resume the victim's session without credentials or a second factor 5. The fix adds a bounds check before the response is sent 6.

Patching did not invalidate sessions that had already leaked. Mandiant saw session data stolen before the upgrade being used after it 4. This is why Citrix told admins to clear all active and persistent sessions after upgrading 7.

What to do

In order of priority
  1. 1

    Upgrade to the fixed builds listed in CTX579459. Version 12.1 is end-of-life and has no fix, so move to a supported fixed release 1.

  2. 2

    Immediately after upgrading, terminate all active and persistent sessions (ICA, RDP, PCoIP and AAA sessions, plus load-balancing persistent sessions), as Citrix's guidance describes 7. Take the exact commands from Citrix's current NetScaler documentation.

  3. 3

    Hunt for malicious activity and report positive findings to CISA. CISA's guidance page also points to BOD 23-02 on reducing exposure of internet-facing management interfaces 2.

  4. 4

    Assume breach if the appliance was unpatched while exploitation was active, given that stolen sessions survive the patch 4. Follow the joint advisory's hunting and incident response guidance 3. Mandiant saw credential theft after hijacks 5, so consider resetting credentials for accounts that used the gateway and check reachable hosts for the activity described above.

Detection

  • The appliance's web server does not log requests to the vulnerable endpoint, and Mandiant knows of no setting that turns this on. Look for requests to /oauth/idp/.well-known/openid-configuration with unusually long Host headers in WAF, reverse proxy or network logs in front of the appliance 5.
  • In /var/log/ns.log, review SSLVPN TCPCONNSTAT entries where Client_ip (where the session was created) differs from Source (where it is now used). Check ASN and geolocation before escalating. Default rotation keeps only about 2.5 MB, so rely on forwarded syslog for history 5.
  • Flag a single source IP that accesses several user accounts within hours. Exclude shared NAT and known egress points 5.
  • On Citrix VDA hosts, the ClientName and ClientIP values under HKLM\SOFTWARE\Policies\Citrix\SESSION_NUMBER\Evidence record the connecting machine. Correlate them with ns.log and hunt the values in Windows Event IDs 4624, 21, 23, 24 and 25. Default DESKTOP- hostnames warrant a closer look 5.
  • Before any reboot, capture an NSPPE core dump manually, because exploitation does not crash the process. Search it for very long strings made almost entirely of 0 characters. These show that exploitation was attempted but cannot prove success 5.
  • After a hijack, Mandiant saw AD reconnaissance with net.exe, network scanning, LSASS dumping, a .NET backdoor using Slack for C2 (FREEFIRE), and RMM tools such as Atera, AnyDesk and SplashTop. Hunt for these on hosts reachable through the gateway 5.

Indicators

As published by the cited sources
TypeValueContext
url path/oauth/idp/.well-known/openid-configurationVulnerable unauthenticated endpoint; review WAF/proxy logs for oversized Host headers5
url path/oauth/rp/.well-known/openid-configurationSecond vulnerable endpoint (relying-party variant)6
file path%temp%\1.pngLSASS memory dump written during post-exploitation observed by Mandiant5
otherMD5 eb842a9509dece779d138d2e6b0f6949FREEFIRE .NET backdoor sample referenced by Mandiant YARA rule M_Hunting_Backdoor_FREEFIRE5

Timeline

  1. Citrix publishes CTX579459 with fixed builds 1

  2. Citrix updates CTX579459 to confirm exploitation on unmitigated appliances 1

  3. Mandiant reports zero-day exploitation since late August 2023 4

  4. CISA adds CVE-2023-4966 to KEV 2

  5. Assetnote publishes root cause showing session cookie leak 6

  6. Mandiant publishes hijacking investigation guide; four UNC groups tracked 5

  7. Over 10,400 servers still vulnerable; LockBit use reported 8

  8. Citrix again urges admins to kill all sessions after upgrading, per BleepingComputer 7

  9. CISA, FBI, MS-ISAC and ASD's ACSC issue joint LockBit 3.0 advisory 3

Sources

  1. 1
    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2023-4966 and CVE-2023-4967 (CTX579459)
    Citrix · Vendor · Oct 10, 2023
  2. 2
    Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix Bleed
    CISA · Government
  3. 3
    CISA, FBI, MS-ISAC, and ASD's ACSC Release Advisory on LockBit Affiliates Exploiting Citrix Bleed
    CISA · Government · Nov 21, 2023
  4. 4
    Remediation for Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)
    Mandiant (Google Cloud) · Research · Oct 17, 2023
  5. 5
    Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966)
    Mandiant (Google Cloud) · Research · Oct 31, 2023
  6. 6
    Citrix Bleed: Leaking Session Tokens with CVE-2023-4966
    Assetnote (Searchlight Cyber) · Research · Oct 24, 2023
  7. 7
    Citrix warns admins to kill NetScaler user sessions to block hackers
    BleepingComputer · News · Nov 21, 2023
  8. 8
    LockBit ransomware exploits Citrix Bleed in attacks, 10K servers exposed
    BleepingComputer · News · Nov 14, 2023
  9. 9
    'Citrix Bleed' vulnerability targeted by nation-state and criminal hackers: CISA
    The Record · News · Nov 21, 2023

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 9 sources, then checked against them by a separate review step on Oct 22, 2026.

Fixed builds and exploitation were checked against Citrix's bulletin CTX579459 and CISA's guidance page.

The Boeing Distribution detail comes from The Record's reporting on the joint advisory; the full advisory text was not reviewed directly.

Citrix's bulletin as published now does not show a CVSS score. The 9.4 rating is reported by Assetnote and The Record, and the vector string was not checked against a primary source.

Spotted an error? Open an issue on sochub.io.