CVE-2023-4966Citrix Bleed, session-token leak from NetScaler ADC
What broke
NetScaler ADC and Gateway (the Citrix ADC/Gateway pair) would over-read a buffer and return memory that contained live session cookies. An unauthenticated caller harvested tokens and replayed them. MFA on the original login did not matter. The session already existed. CISA added CVE-2023-4966 to KEV. Public name: Citrix Bleed. October 2023.
Why it matters
This is session hijacking as a product bug, not a stolen laptop. Identity teams who measure success as "MFA is on" learned that a gateway cookie is a bearer credential. The same lesson shows up later in Pass-the-Passkey and in our infostealer teardown.
What to do
- Patch ADC/Gateway, then terminate all sessions. A patched box with live leaked cookies is still owned.
- Hunt for sessions that have no matching interactive login, especially from new ASNs after 10 October 2023.
- Bind gateway sessions to a device or client where the product allows it. Shorten idle timeouts.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2023-4966
- CISA KEV / Citrix Bleed advisories, October 2023
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- Comcast Xfinity customer data theft via Citrix Bleed 2023 · Identity infrastructure vulnerability
- Boeing Distribution breached by LockBit via Citrix Bleed session hijacking 2023 · Identity infrastructure vulnerability
Related on Start with Identity
- CVENetScaler SAML memory overflow exploited as a zero-day
CVE-2026-88779 is a memory overflow in NetScaler ADC and Gateway reachable only when the appliance acts as a SAML service provider or identity provider. Exploit
- CVENetScaler Gateway and AAA authentication bypass with SAML configured
CVE-2026-19490 lets an attacker bypass authentication on NetScaler ADC and Gateway appliances running a Gateway or AAA virtual server. CVSS 9.3, shipped alongsi
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a