"Citrix advises users of NetScaler ADC and Gateway products to apply updates immediately"
In a series of recent cyber-attacks, hackers have targeted the NetScaler ADC and NetScaler Gateway systems, exploiting a vulnerability identified as CVE-2023-4966. This out-of-bounds memory read flaw can lead to data disclosure, session hijacking, and bypassing Multi-Factor Authentication (MFA).
To address this critical issue, Citrix released patches on October 10. However, Mandiant has reported that threat actors have found ways to bypass the patch in some cases, emphasising the need for additional measures.
The vulnerability is most critical when NetScaler ADC is configured as a gateway or as an AAA virtual server. As a result, organisations are urged to take immediate action to protect their systems.
Key mitigation steps include:
- Upgrade to the latest fixed firmware versions for NetScaler ADC and Gateway products. Older versions, particularly 12.1 and 13.0, which are End-of-Life (EOL), remain vulnerable and unsupported.
- Terminate all active sessions, including ICA, PCoIP, RDP, AAA, and Load Balancing persistent sessions, after patching. This will eliminate any existing sessions potentially compromised prior to the upgrade.
- Restrict public exposure of NetScaler management and authentication interfaces. Use IP allowlists, strong access control lists (ACLs), internal-only network zones, and network segmentation consistent with Zero Trust principles to limit lateral movement if exploited.
- Enable rate limiting and session throttling on authentication endpoints to detect and block enumeration attacks or abuse patterns exploiting the vulnerability.
- Deploy IDS/IPS or deep packet inspection (DPI) tools to detect exploit attempts by analysing inbound HTTP traffic for attack signatures targeting authentication workflows.
- Continuously monitor and analyse NetScaler logs to detect anomalous activity and conduct proactive threat hunting, auditing privileged sessions and internal flows for signs of compromise.
These recommendations come in response to CVE-2023-4966 and its successor vulnerability, CVE-2025-5777. The latter prompted similar guidance on patching, session termination, and network hardening.
Mandiant’s warnings, while not explicitly detailed, align with this overall approach: prioritise timely patching, limit attack surface exposure, terminate previously established sessions, and monitor actively for exploitation signs to mitigate and prevent damage from CVE-2023-4966 and related memory leak vulnerabilities in Citrix NetScaler products.
The Cybersecurity and Infrastructure Security Agency has added NetScaler ADC and NetScaler Gateway to its Known Exploited Vulnerabilities catalog, highlighting the urgency of the situation. The evolving role of Chief Information Security Officers (CISOs) is underscored as they grapple with understanding and managing these potential threats.
- In light of the critical vulnerability identified as CVE-2023-4966 in Citrix NetScaler ADC and Gateway systems, it's crucial for organizations to implement immediate measures to protect their data-and-cloud-computing infrastructure.
- As threats actors have found ways to bypass the patch for CVE-2023-4966, security professionals must consider additional strategies such as terminating all active sessions, implementing network segmentation, and deploying IDS/IPS tools for enhanced cybersecurity.
- General-news outlets and crime-and-justice reports have emphasized the importance of timely patching, limiting attack surface exposure, and proactive threat hunting to mitigate damage from exploitations of vulnerabilities like CVE-2023-4966 and its successor, CVE-2025-5777, in the ever-evolving world of technology.
