{
  "schema": "niftibot-us-cti-sample/v1",
  "is_sample": true,
  "captured_at": "2026-11-03T16:38:02.881353+00:00",
  "query": "CVE-2023-4966",
  "tool": "cti_get_vulnerability",
  "data": {
    "cve_id": "CVE-2023-4966",
    "in_kev": true,
    "watched": true,
    "kev": {
      "vendor_project": "Citrix",
      "product": "NetScaler ADC and NetScaler Gateway",
      "vulnerability_name": "Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability",
      "short_description": "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.",
      "date_added": "2023-10-18",
      "due_date": "2023-11-08",
      "required_action": "Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.",
      "known_ransomware_use": "Known",
      "cwes": [
        "CWE-119"
      ]
    },
    "nvd": {
      "cve_id": "CVE-2023-4966",
      "description": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.",
      "published_at": "2023-10-10T14:15:10.977000+00:00",
      "nvd_last_modified": "2026-07-31T04:16:44.230000+00:00",
      "cvss_version": "3.1",
      "cvss_base": 9.4,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
      "cvss_severity": "CRITICAL",
      "cwe_ids": [
        "CWE-119"
      ],
      "affected_cpe_count": 4
    },
    "threat": {
      "exploitation_status": "kev_ransomware",
      "severity_band": "critical",
      "remediation_state": "overdue",
      "markers": {
        "cvss_base": 9.4,
        "cvss_version": "3.1",
        "cwe_ids": [
          "CWE-119"
        ],
        "affected_cpe_count": 4,
        "ioc_count_30d": 0,
        "ioc_sources": [],
        "known_ransomware_use": true
      }
    },
    "events": [
      {
        "event_type": "kev.ransomware_flagged",
        "occurred_at": "2026-10-09T23:40:50.830031+00:00",
        "observed_at": "2026-10-10T07:38:03.089840+00:00"
      },
      {
        "event_type": "nvd.cvss_changed",
        "occurred_at": "2026-07-31T04:16:44.230000+00:00",
        "observed_at": "2026-10-10T12:42:00.594674+00:00"
      },
      {
        "event_type": "nvd.cpe_changed",
        "occurred_at": "2026-07-31T04:16:44.230000+00:00",
        "observed_at": "2026-10-10T12:42:00.594674+00:00"
      },
      {
        "event_type": "kev.due_reached",
        "occurred_at": "2023-11-08T00:00:00+00:00",
        "observed_at": "2026-10-10T07:38:03.089840+00:00"
      },
      {
        "event_type": "watchlist.entered",
        "occurred_at": "2023-10-18T00:00:00+00:00",
        "observed_at": "2026-10-10T07:38:03.089840+00:00"
      },
      {
        "event_type": "kev.added",
        "occurred_at": "2023-10-18T00:00:00+00:00",
        "observed_at": "2026-10-10T07:38:03.089840+00:00"
      }
    ],
    "iocs": [],
    "sources": [
      {
        "source": "cisa.gov",
        "licence": "US-PD",
        "status": "online",
        "last_synced_at": "2026-11-03T16:18:30.076110+00:00",
        "matched_records": 1
      },
      {
        "source": "nvd.nist.gov",
        "licence": "US-PD",
        "status": "online",
        "last_synced_at": "2026-11-03T15:50:00.592101+00:00",
        "matched_records": 1
      },
      {
        "source": "threatfox.abuse.ch",
        "licence": "CC0-1.0",
        "status": "online",
        "last_synced_at": "2026-11-02T19:23:00.680063+00:00",
        "matched_records": 0
      },
      {
        "source": "urlhaus.abuse.ch",
        "licence": "CC0-1.0",
        "status": "online",
        "last_synced_at": "2026-11-01T07:06:00.727183+00:00",
        "matched_records": 0
      }
    ]
  },
  "provenance": {
    "source": "cisa.gov",
    "uri": "https://nvd.nist.gov/vuln/detail/CVE-2023-4966",
    "retrieved_at": "2026-11-03T16:38:02.881353+00:00",
    "sha256": "5b937aed9e7b5a81ff680d9414a0871c7268e4378031b41c50af90fcc1d34b9b"
  },
  "licence": "US Government works in the public domain (CISA KEV, NIST NVD) and CC0 1.0 public-domain data (abuse.ch ThreatFox, URLhaus), reused with attribution. Not affiliated with CISA, NIST or abuse.ch.",
  "caveats": [
    "Sanitized response captured from the local US CTI service.",
    "Point-in-time data; verify consequential details with the cited source.",
    "Absence from KEV or IOC results is not proof that a vulnerability is not exploited.",
    "This service provides threat intelligence data, not incident response or operational security advice."
  ]
}