NetScaler - Information Disclosure (CVE-2023-4966)

CVE-2023-4966 is a critical vulnerability in NetScaler ADC and NetScaler Gateway, which can lead to sensitive information disclosure when the system is configured as a gateway or virtual server.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2023-4966 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2023-4966 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Observed exploitation attempts target URLs containing /oauth/idp/.well-known/openid-configuration.