NetScaler - Information Disclosure (CVE-2023-4966)
89Exploiting IPs reported
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
CrowdSec analysis
CVE-2023-4966 is a critical vulnerability in NetScaler ADC and NetScaler Gateway, which can lead to sensitive information disclosure when the system is configured as a gateway or virtual server.
CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.
CrowdSec network observations suggest that most exploitation of CVE-2023-4966 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2023-4966 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Observed exploitation attempts target URLs containing /oauth/idp/.well-known/openid-configuration.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.