CVE-2023-4967: Denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-27 · updated 2026-06-17
Weakness: CWE-119

Description

Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server

Affected products

Citrix NetScaler ADC: from 13.0 before 13.0-92.19; from 13.1 before 13.1-49.15; from 14.1 before 14.1-8.50 — fixed in 13.0-92.19, 13.1-49.15, 14.1-8.50
Citrix Netscaler Application Delivery Controller Fips: from 12.1 through 12.1-55.300; from 13.1 through 13.1-37.164
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 through 12.1-55.300
Citrix NetScaler Gateway: from 13.0 before 13.0-92.19; from 13.1 before 13.1-49.15; from 14.1 before 14.1-8.50 — fixed in 13.0-92.19, 13.1-49.15, 14.1-8.50
Citrix NetScaler ADC: from 14.1 before 8.50; from 13.1 before 49.15; from 13.0 before 92.19; from 13.1-FIPS before 37.164; from 12.1-FIPS before 55.300; from 12.1-NDcPP before 55.300 — fixed in 8.50, 49.15, 92.19, 37.164, 55.300
Citrix NetScaler Gateway: from 14.1 before 8.50; from 13.1 before 49.15; from 13.0 before 92.19 — fixed in 8.50, 49.15, 92.19

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.0-92.19, 13.1-49.15, 14.1-8.50; Citrix NetScaler Gateway 13.0-92.19, 13.1-49.15, 14.1-8.50; Citrix NetScaler ADC 8.50, 49.15, 92.19, 37.164; Citrix NetScaler Gateway 8.50, 49.15, 92.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4967 or the next vulnerability affects your stack