cyberresearch.us

TLP:CLEAR confidence:low · #cyber-news #critical

[MàJ] Vulnérabilité dans Citrix NetScaler ADC et NetScaler Gateway (23 octobre 2023)

Luke Johnson / Cyber Research US

Summary

Public advisories describe several Citrix NetScaler ADC / NetScaler Gateway problems that are not clearly the same event: a 2023 session-disclosure issue (CVE-2023-4966) with confirmed in-the-wild use (CERT-FR, citing Citrix, Mandiant, and CISA), and two 2026 advisory sets that name different CVEs and effects (NCSC-NL vs CERT-EU). The 2026 reports cover memory overreads (especially as a SAML IdP), session mix-up, DoS via HTTP/2 or memory mismanagement, and unauthenticated management-interface file read; researchers published PoCs for at least one 2026 bug, including a later RCE PoC limited to SAML IdP. This memo only synthesizes those public reports and does not independently reverse or lab the issues.

Attack vector

2026 (NCSC-NL): Reachability depends on role. Memory-overread issues (CVE-2026-8451, CVE-2026-10817) require the appliance as a SAML Identity Provider, or TCP Timestamp enabled on a TCP profile bound to a Load Balancing, Content Switching, or VPN virtual server. Memory-management issues (CVE-2026-8452, CVE-2026-8655) apply when configured as Gateway, DNS proxy, recursive DNS resolver, or AAA virtual server. CVE-2026-13474 is triggered with specially crafted HTTP/2 requests. CVE-2026-10816 is an unauthenticated remote attack against the Management Interface (file read).

2026 (CERT-EU): Internet-facing appliances configured as a SAML IdP (CVE-2026-3055), or as Gateway (SSL VPN, ICA Proxy, CVPN, RDP proxy) or AAA virtual server (CVE-2026-4368). CERT-EU also flags builds before 14.1-66.59 / 13.1-62.23 / 13.1-37.262 (FIPS/NDcPP, ADC only).

2023 (CERT-FR): Internet-exposed NetScaler ADC/Gateway on the listed pre-patch trains. This article does not name the HTTP path or protocol feature used to reach CVE-2023-4966.

Exploit

2026 (NCSC-NL): Insufficient input validation (sizes/bounds not checked) causes memory overreads and unauthorized disclosure of sensitive data (CVE-2026-8451, CVE-2026-10817). Separate memory-management bugs can cause DoS or “unwanted control flow” (CVE-2026-8452, CVE-2026-8655). Improper memory release plus crafted HTTP/2 yields DoS (CVE-2026-13474). Broken access control on the Management Interface lets an unauthenticated remote attacker read arbitrary files (CVE-2026-10816). Researchers published a PoC for CVE-2026-8451; the same researchers later published a PoC that NCSC-NL says can yield arbitrary code execution, but only if the box is a SAML IdP (called an uncommon / non-best-practice layout).

2026 (CERT-EU): CVE-2026-3055 is an out-of-bounds read (CVSS 9.3) that can leak memory on SAML IdP systems. CVE-2026-4368 is a race that can mix user sessions (CVSS 7.7) on Gateway/AAA. No exploit tooling is named.

2023 (CERT-FR): CVE-2023-4966 is described as a confidentiality bug that, in practice, lets an attacker take over active sessions at the victim user’s privilege, bypassing MFA. Mandiant (via CERT-FR) states patching alone does not evict an attacker who already stole session material.

In the wild / novelty

  • CVE-2023-4966: Disclosure 10 Oct 2023 (Citrix CTX579459). Citrix updated 17 Oct 2023 to acknowledge active exploitation; Mandiant reported exploitation since late August 2023. CISA (21 Nov 2023, per CERT-FR) described large-scale campaigns including ransomware. CERT-FR treated unpatched appliances as presumed compromised. This is confirmed victim/campaign exploitation, not just disclosure.
  • 2026 CERT-EU set (CVE-2026-3055, CVE-2026-4368): Vendor advisory 23 Mar 2026. CERT-EU: no public evidence of active exploitation at time of writing.
  • 2026 NCSC-NL set: Public PoC for CVE-2026-8451, then a further RCE PoC under SAML IdP. That is disclosure + public PoC, not stated victim exploitation.

Risk

Internet-facing Gateways/AAA and SAML IdP ADCs are the priority blast radius. Successful abuse can leak memory (session tokens, other secrets), mix one user into another’s session, read arbitrary files from the management plane, or deny service (HTTP/2 / memory bugs). The 2023 issue specifically enables MFA bypass via stolen sessions and persistence after patch if sessions are not killed. NCSC-NL’s later PoC raises RCE risk only for SAML IdP. A successful Gateway compromise typically exposes downstream apps, ICA/VPN/RDP sessions, and identity material bound to the appliance.

Remediation

Grounded in the cited advisories (not independently validated):

  • Patch to the builds named by each advisory. CERT-EU: 14.1-66.59, 13.1-62.23, 13.1-37.262 (FIPS/NDcPP ADC). CERT-FR 2023 trains are older (e.g. 14.1-8.50, 13.1-49.15, 13.0-92.19, plus FIPS/NDcPP floors) and apply only to CVE-2023-4966. NCSC-NL does not list version floors in the provided text—use the matching Citrix bulletin.
  • Until patched: restrict NetScaler Gateway and AAA with network allowlisting (CERT-EU); apply Citrix Global Deny List mitigation where available (no reboot, CERT-EU).
  • After patch: terminate sessions so stolen tokens cannot be reused — CERT-EU: kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all, clear lb persistentSessions. CERT-FR additionally: reset passwords for accounts on vulnerable gateways and investigate as if compromised if CVE-2023-4966 was unpatched during the 2023 window.
  • Snapshot appliances before patching to preserve forensic evidence (CERT-EU). CERT-FR points to Citrix/NetScaler investigation guidance and CISA AA23-325a for 2023 hunting.
  • Note a known STA binding issue in 14.1-66.54 and 14.1-66.59 when STA is set with full path /scripts/ctxsta.dll (CERT-EU).
  • Prioritize internet-facing SAML IdP and Gateway/AAA (both 2026 sources). NCSC-NL notes SAML-as-IdP is not a usual best-practice split of IdM/AM.

Vendor refs as published: hxxps://support[.]citrix[.]com/support-home/kbsearch/article?articleNumber=CTX696300 (CERT-EU); CTX579459 for CVE-2023-4966 (CERT-FR).

CVE / identifiers

CVE-2026-8451, CVE-2026-10817, CVE-2026-8452, CVE-2026-8655, CVE-2026-13474, CVE-2026-10816 (NCSC-NL / NCSC-2026-0216); CVE-2026-3055, CVE-2026-4368 (CERT-EU 2026-003); CVE-2023-4966 (and CVE-2023-4967 named only in a Citrix URL on CERT-FR). Advisories: NCSC-2026-0216, CERT-EU 2026-003, CERTFR-2023-ALE-012, Citrix CTX696300, CTX579459. No CWE IDs stated.

Confidence

low — this is a synthesis of public reporting only. The three articles disagree on CVE IDs, dates, and impact (2023

Sources