Security News > 2023 > October > Citrix urges 'immediate; patch for critical NetScaler bug as exploit POC made public

Citrix urges 'immediate; patch for critical NetScaler bug as exploit POC made public
2023-10-24 21:00

Citrix has urged admins to "Immediately" apply a fix for CVE-2023-4966, a critical information disclosure bug that affects NetScaler ADC and NetScaler Gateway, admitting it has been exploited.

Plus, there's a proof-of-concept exploit, dubbed Citrix Bleed, now on GitHub.

Six days after the Google-owned threat intel firm sounded the alarm, Citrix weighed in.

Oddly, Citrix didn't release any additional details about these targeted attacks, which Mandiant last week said were used to hit tech firms, government organizations, and professional services companies.

A Citrix spokesperson declined to comment on how many organizations have been compromised, and who or what the criminals are targeting in the attacks.

"The security bulletin and blog are the extent of our external statements at this time," the Citrix spokesperson told The Register.


News URL

https://go.theregister.com/feed/www.theregister.com/2023/10/24/citrix_critical_patch/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2023-10-10 CVE-2023-4966 Unspecified vulnerability in Citrix products
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA ?virtual?server. 
network
low complexity
citrix
7.5

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Citrix 116 19 175 79 65 338