Ad

CVE-2023-4966

HIGH CVSS 3.1: 7.5
Updated Oct 24, 2025
Citrix
Parameter Value
CVSS 7.5 (HIGH)
Affected Versions 12.1 — 14.1-8.50
Fixed In 12.1-55.300
Type CWE-119 (Buffer Overflow)
Vendor Citrix
Public PoC Yes

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

Vulnerable Products 9

Configuration From (including) Up to (excluding)
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
12.1 12.1-55.300
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
12.1 12.1-55.300
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
13.0 13.0-92.19
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
13.1 13.1-37.164
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
13.1 13.1-49.15
Citrix Netscaler_Application_Delivery_Controller
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
14.1 14.1-8.50
Citrix Netscaler_Gateway
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
13.0 13.0-92.19
Citrix Netscaler_Gateway
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
13.1 13.1-49.15
Citrix Netscaler_Gateway
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
14.1 14.1-8.50