ctrlINT What the industry said about every indicator, with the quote

CVE-2023-4966Vulnerability

Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 4 independent sources · first reported by GreyNoise · last reported

Last reported 8 days ago

CISA KEVAdded 18 Oct 2023
Fix due 8 Nov 2023
Used by ransomware: knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 26 Sep 2026

What the reports say

5 reports, newest first · the exact sentence from each

  1. “The threat actor was previously seen exploiting zero-days in Citrix NetScaler (CVE-2023-4966, aka CitrixBleed), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282), and Dell RecoverPoint for Virtual Machines (CVE-2026-22769).”

    SecurityWeekNews
    Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

  2. “Armory Castle has a history of exploiting zero-day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances to break a wide range of sectors, including legal services, SaaS providers, business-pro…”

    The Hacker NewsNews
    China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

  3. “CVE-2025-5777, nicknamed "CitrixBleed 2" in the spirit of the original 2023 CitrixBleed (CVE-2023-4966) is a memory-overread in NetScaler ADC and Gateway when configured as a Gateway or AAA virtual server.”

    HuntressVendor
    CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware

  4. “CVE-2023-4966 – Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability”

    GreyNoiseVendor
    GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs

  5. “CVE-2023-4966 — Citrix NetScaler ADC Buffer Overflow”

    GreyNoiseVendor
    U.S. and UK Warn of Russian Cyber Threats: 9 of 12 GreyNoise-Tracked Vulnerabilities in the Advisory Are Being Probed Right Now

Indicators reported together

named in the same reports

Also named with it: CVE-2023-20198, CVE-2024-21887, CVE-2023-46805, CVE-2025-0282, CVE-2023-42793, CVE-2023-29357, CVE-2026-102764, CVE-2025-5777, CVE-2026-22769, CVE-2017-11882, CVE-2023-38831, CVE-2023-36884, CVE-2017-5753, CVE-2020-1472, CVE-2022-27925, CVE-2021-26855, CVE-2024-21762, CVE-2022-41082, CVE-2023-23397, CVE-2024-3400

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2023-4966 here?
No account needed. We do not store your IP address.