Technical intelligence and weaponization dossier for CVE-2023-4966. Documented exploitation across 0 active malware families totaling 0 analyzed telemetry samples.
| Vulnerability ID | CVE-2023-4966 |
|---|---|
| Common Name / Bulletin | Citrix NetScaler ADC & Gateway Sensitive Information Disclosure (Citrix Bleed) (CTX579459) |
| CWE Classification | CWE-119: Buffer Over-read in OpenID Connect Endpoint |
| Affected Software & Versions | NetScaler ADC and NetScaler Gateway versions 13.0, 13.1, 14.1 |
| Technical Root Cause | Buffer over-read in OpenID Connect endpoint (/oauth/idp/.well-known/openid-configuration) leaking active administrative and user session cookies, bypassing MFA completely. Heavily weaponized by LockBit. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 0 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-4966 in enterprise networks:
Web server logs with HTTP GET requests to /oauth/idp/.well-known/openid-configuration with Host headers exceeding 25,000 bytes; sudden session hijacking with valid cookie from new IP.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →