Citrix warned admins today to secure all NetScaler ADC and Gateway appliances immediately against ongoing attacks exploiting the CVE-2023-4966 vulnerability.
NetScaler appliances must be configured as a Gateway or an AAA virtual server to be vulnerable to attacks.
The cybersecurity company said threat actors had been exploiting CVE-2023-4966 as a zero-day since late August 2023 to steal authentication sessions and hijack accounts, which could help the attackers bypass multifactor authentication or other strong auth requirements.
NetScaler ADC and NetScaler Gateway devices, when not set up as gateways or as AAA virtual servers, are not vulnerable to CVE-2023-4966 attacks.
Recently patched Citrix NetScaler bug exploited as zero-day since August.
Cisco warns of new IOS XE zero-day actively exploited in attacks.
