# MA-992.112023: MyCERT Advisory - Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix Bleed

**Date:** 24 Nov 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-992.112023  
**Advisory ID:** MA-992.112023

---

**1.0 Introduction**
On October 10, 2023, Citrix released a [security bulletin for a sensitive information disclosure vulnerability (CVE-2023-4966)](https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967) impacting NetScaler ADC and NetScaler Gateway appliances. Citrix Bleed is a critical vulnerability affecting Citrix Netscaler Gateway and Netscaler ADC products—network devices used for load balancing, firewall implementation, traffic management, virtual private network (VPN), and user authentication.
It has been reported thatthe LockBit 3.0 ransomware attacks use publicly available exploits the Citrix Bleed vulnerability (CVE-2023-4966) to breach the systems of large organizations, steal data, and encrypt files. Although Citrix made fixes available for CVE-2023-4966 more than a month ago, thousands of internet-exposed endpoints are still running vulnerable appliances worldwide.
**2.0 Impact**
Successful exploitation could result in the ability to hijack existing authenticated sessions, therefore bypassing multifactor authentication or other strong authentication requirements. The authenticated session hijacking could then result in further downstream access based on the permissions and scope of access that the identity or session was permitted. A threat actor could utilize this method to harvest additional credentials, laterally pivot, and gain access to additional resources within an environment.
**3.0 Affected Products**
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
- NetScaler ADC and NetScaler Gateway?14.1?before?14.1-8.50
- NetScaler ADC and NetScaler Gateway?13.1?before?13.1-49.15
- NetScaler ADC and NetScaler Gateway?13.0?before 13.0-92.19
- NetScaler ADC 13.1-FIPS before 13.1-37.164
- NetScaler ADC 12.1-FIPS before 12.1-55.300
- NetScaler ADC 12.1-NDcPP before 12.1-55.300
Note: NetScaler ADC and NetScaler Gateway version 12.1 is now End-of-Life (EOL) and are vulnerable.
**4.0 Recommendations**
MyCERT urges organisations to update unpatched appliances to the updated versions listed below:
- NetScaler ADC?and NetScaler Gateway 14.1-8.50 and later releases
- NetScaler ADC?and NetScaler Gateway 13.1-49.15 and later releases of 13.1
- NetScaler ADC?and NetScaler Gateway 13.0-92.19 and later releases of 13.0?
- NetScaler ADC 13.1-FIPS 13.1-37.164 and later releases of 13.1-FIPS?
- NetScaler ADC 12.1-FIPS 12.1-55.300 and later releases of 12.1-FIPS?
- NetScaler ADC 12.1-NDcPP 12.1-55.300 and later releases of 12.1-NDcPP
- **Note:** NetScaler ADC and NetScaler Gateway version 12.1 are now End-of-Life (EOL). Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed>
- <https://services.google.com/fh/files/misc/citrix-netscaler-adc-gateway-cve-2023-4966-remediation.pdf>
- <https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967>
- <https://www.acaglobal.com/insights/thousands-servers-exposed-citrix-bleed-vulnerability>
- <https://www.cisa.gov/news-events/alerts/2023/11/16/citrix-releases-security-updates-citrix-hypervisor-0>
- <https://www.bleepingcomputer.com/news/security/lockbit-ransomware-exploits-citrix-bleed-in-attacks-10k-servers-exposed/>
- <https://support.citrix.com/article/CTX583037/citrix-hypervisor-security-bulletin-for-cve202323583-and-cve202346835>