CVE-2023-4966Tuesday, January 20, 2026

Citrix Bleed - NetScaler ADC/Gateway Memory Leak Vulnerability

A security vulnerability in Citrix NetScaler ADC and Gateway allows an unauthenticated remote attacker to cause a memory leak that can lead to the disclosure of sensitive information including session tokens and credentials.

Not KEV Listed✓ Fix Available
Citrix Bleed - NetScaler ADC/Gateway Memory Leak Vulnerability
💡

This section explains the vulnerability in everyday language, so anyone can understand the risk and impact.

Citrix Bleed is a serious security flaw affecting Citrix NetScaler devices, which are commonly used by businesses to manage web traffic and provide remote access. The vulnerability allows attackers to steal sensitive information like login credentials and session tokens without needing any password or special access.

Think of it like a leaky pipe in a building's plumbing system - except instead of water, it's leaking private information that should stay secure. Attackers can repeatedly request information from affected Citrix devices, and due to this flaw, the devices accidentally reveal bits of sensitive data they shouldn't.

This vulnerability is particularly dangerous because it's easy to exploit and can give attackers the keys to access corporate networks and sensitive systems. Many major organizations use these Citrix devices, making this a significant security concern for businesses worldwide.

Affected Products

2affected products identified
ProductVendorVersionPatched
>NetScaler ADCCitrix11.1, 12.1, 13.0, 13.113.1-49.15+
>NetScaler GatewayCitrix11.1, 12.1, 13.0, 13.113.1-49.15+
🔧

Remediation

Fix Available

1. Immediately upgrade to the latest supported version

2. For 13.1: Upgrade to 13.1-49.15 or later

3. For 13.0: Upgrade to 13.0-92.12 or later

4. For 12.1: Upgrade to 12.1-63.21 or later

5. If immediate upgrade is not possible, implement recommended mitigation steps including enabling HSTS and implementing IP address restrictions

🔗

Sources & References

CVSS Score
9.4
CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Vector (v3.1)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Quick Info
CVE IDCVE-2023-4966
Severitycritical
FixAvailable
KEVNot Listed
PublishedJan 20, 2026