{"id":"CVE-2023-4966","aliases":[],"url":"https://o3.security/vulnerability/CVE-2023-4966","summary":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.","details":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.","published":"2023-10-10T13:12:17.644Z","modified":"2026-07-31T03:55:28.627Z","cvss":{"score":9.4,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"score":0.99999,"percentile":0.99997,"asOf":"2026-08-27"},"cisaKev":{"dateAdded":"2023-10-18","dueDate":"2023-11-08","knownRansomwareCampaignUse":true},"exploitsKnown":14,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://support.citrix.com/article/CTX579459"},{"type":"WEB","url":"http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4966"}],"provenance":{"sources":["OSV.dev","NVD","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-07-31T03:55:28.627Z"}}