Citrix Bleed NetScaler Session Token Leak (CVE-2023-4966)

CVE-2023-4966 (nicknamed Citrix Bleed) is a buffer overread in Citrix NetScaler ADC and Gateway. Attackers leak session tokens from memory and hijack authenticated VPN/admin sessions without credentials — CISA KEV listed.

Affected Citrix

• NetScaler ADC and Gateway 14.1 before 14.1-8.50
• NetScaler ADC and Gateway 13.1 before 13.1-49.15
• NetScaler ADC 13.0 before 13.0-92.19 (EOL branch)

Check version

show version
show ns config | grep -i ssl

Patching Method

1. Download fixed NetScaler build from Citrix downloads portal.
2. Schedule maintenance — active sessions will be terminated on reboot.
3. Install via GUI: Configuration → System → Upgrade or CLI install ns workflow per Citrix KB.
4. Reboot appliance; confirm version matches advisory fixed table.
5. Force global session reset — invalidate all existing tokens post-patch.
6. Rotate admin passwords and MFA seeds; review AAA logs for hijacked sessions.

# CLI version check after patch
show version
clear ssl session -all

Until patched

• Block NetScaler VPN portal from internet if possible
• Enable MFA on all Citrix-published apps
• Monitor for logins from unusual geographies after token leak window