VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 09:28 UTC
← Dashboard

CVE-2023-4966

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CVSS 9.4 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.9/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.4: +1.41
  • Fresh EPSS: 100.00%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 31 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

CSO Online
Press · 03 Jul 2026, 07:00 · New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild - CSO Online
CyberSecurityNews
Press · 19 Jun 2026, 07:00 · INC Ransomware Uses Rust-Based Windows and Linux/ESXi Encryptors in New Attacks - CyberSecurityNews
The Hacker News
Press · 24 Mar 2026, 07:00 · Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks - The Hacker News
wiz.io
Press · 06 Jul 2025, 07:00 · Critical vulnerabilities in NetScaler ADC exploited in-the-wild: everything you need to know - wiz.io
Help Net Security
Press · 30 Jun 2025, 07:00 · CitrixBleed 2 might be actively exploited (CVE-2025-5777) - Help Net Security
See all 31 source documents
GreyNoise
Press · 26 Feb 2025, 08:00 · GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs - GreyNoise
TechTarget
Press · 30 Apr 2024, 07:00 · Change Healthcare breached via Citrix portal with no MFA - TechTarget
Morphisec
Press · 13 Dec 2023, 08:00 · Responding to CitrixBleed (CVE-2023-4966): Key Takeaways from Affected Companies - Morphisec
GovTech
Press · 06 Dec 2023, 08:00 · What Is Citrix Bleed? The Next Ransomware Patch You Need - GovTech
Help Net Security
Press · 22 Nov 2023, 08:00 · How LockBit used Citrix Bleed to breach Boeing and other targets - Help Net Security
SOC Prime
Press · 22 Nov 2023, 08:00 · LockBit 3.0 Ransomware Attack Detection: CISA, FBI, and International Cyber Authorities Warn Defenders of CVE 2023-4966 Citrix Bleed Vulnerability Exploitation - SOC Prime
The Hacker News
Press · 22 Nov 2023, 08:00 · LockBit Ransomware Exploiting Critical Citrix Bleed Vulnerability to Break In - The Hacker News
Industrial Cyber
Press · 22 Nov 2023, 08:00 · US, Australian security agencies warn of LockBit 3.0 ransomware exploiting Citrix Bleed vulnerability - Industrial Cyber
Cyfirma
Press · 16 Nov 2023, 08:00 · Citrix Bleed: CVE-2023-4966 Vulnerability Analysis and Exploitation - Cyfirma
Computer Weekly
Press · 15 Nov 2023, 08:00 · US government reinforces ICBC hack link to Citrix Bleed - Computer Weekly
TechTarget
Press · 15 Nov 2023, 08:00 · LockBit observed exploiting critical 'Citrix Bleed' flaw - TechTarget
Cybersecurity Dive
Press · 08 Nov 2023, 08:00 · CitrixBleed sparks race to patch, hunt for malicious activity - Cybersecurity Dive
Unit 42
Press · 01 Nov 2023, 07:00 · Threat Brief: Citrix Bleed CVE-2023-4966 - Unit 42
SC Media
Press · 01 Nov 2023, 07:00 · Citrix NetScaler bug protection: Close all active sessions, says Mandiant - SC Media
Google Cloud
Press · 31 Oct 2023, 07:00 · Investigation of Session Hijacking via Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966) - Google Cloud
Ars Technica
Press · 30 Oct 2023, 07:00 · “This vulnerability is now under mass exploitation.” Citrix Bleed bug bites hard - Ars Technica
Help Net Security
Press · 30 Oct 2023, 07:00 · Citrix Bleed: Mass exploitation in progress (CVE-2023-4966) - Help Net Security
DoublePulsar
Press · 27 Oct 2023, 07:00 · Mass exploitation of CitrixBleed vulnerability, including a ransomware group | by Kevin Beaumont - DoublePulsar
GreyNoise
Press · 26 Oct 2023, 07:00 · CVE-2023-4966 Helps Usher In A Baker’s Dozen Of Citrix Tags To Further Help Organizations Mitigate Harm - GreyNoise
BleepingComputer
Press · 25 Oct 2023, 07:00 · Citrix Bleed exploit lets hackers hijack NetScaler accounts - BleepingComputer
The Hacker News
Press · 25 Oct 2023, 07:00 · Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities - The Hacker News
Rapid7
Press · 25 Oct 2023, 07:00 · CVE-2023-4966: Exploitation of Citrix NetScaler Information Disclosure Vuln - Rapid7
Cybersecurity Dive
Press · 18 Oct 2023, 07:00 · Citrix Netscaler patch for critical CVE bypassed by malicious hackers - Cybersecurity Dive
BleepingComputer
Press · 18 Oct 2023, 07:00 · Recently patched Citrix NetScaler bug exploited as zero-day since August - BleepingComputer
TechTarget
Press · 18 Oct 2023, 07:00 · Mandiant: Citrix zero-day actively exploited since August - TechTarget
Google Cloud
Press · 17 Oct 2023, 07:00 · Remediation for Citrix NetScaler ADC and Gateway Vulnerability (CVE-2023-4966) - Google Cloud

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.9 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
mlynchcogent/CVE-2023-4966-POC83—25 Oct 2023, 08:29
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.4; EPSS 100.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:01.465988+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
10 Oct 2023, 13:12
First press mention
17 Oct 2023, 07:00
Added to the CISA KEV catalog
18 Oct 2023, 00:00
Latest press mention
03 Jul 2026, 07:00
Score calculated
05 Nov 2026, 13:59
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar