Citrix Bleed checklist: would your org have caught it?

Citrix Bleed (CVE-2023-4966) let an attacker read memory from a NetScaler appliance and lift a valid session cookie, which gave access without a password or MFA code. You would have caught it only if you knew every edge appliance you ran, patched within days, and could see odd sessions. This checklist tests each step.

What happened, in short?

According to the joint CISA advisory AA23-325A, an HTTP GET request with a crafted Host header made affected NetScaler ADC and Gateway appliances return system memory containing a valid session cookie. The attacker then used that cookie to open an authenticated session. The advisory says this works without a username, password or MFA token.

Exploitation was seen as early as August 2023. Citrix disclosed the flaw on 10 October 2023, and the advisory came out on 21 November 2023. The gap between first use and disclosure is the uncomfortable part. Many defenders were not slow. The fix did not exist yet.

None of this is a story about careless teams. Edge appliances are hard to inventory, hard to patch and often owned by a team that does not run the software pipeline. The goal here is to find your own weak spots.

Would you have known you ran the product?

Ask these first.

• Do you have a current list of internet-facing appliances and their firmware versions, owned by a named person?
• Is that list separate from your application inventory? Software bills of materials describe code you build and ship. They rarely cover a gateway appliance, so this list needs its own source.
• Does the owner receive the vendor's security bulletins directly?

Would you have patched in time?

CISA's advisory urges patching within 24 to 48 hours of disclosure for internet-facing systems on its Known Exploited Vulnerabilities catalog. The catalog is a list CISA keeps of flaws exploited in the wild, and it offers CSV and JSON downloads you can feed into your tooling.

• Can you reach an appliance owner and a change window the same day?
• Do you have a rule that known exploited flaws on internet-facing systems skip the normal queue?
• Where a patch is not ready, can you isolate the appliance? The advisory says to isolate affected appliances until patching is deployable.

Would you have noticed a stolen session?

A patch closes the hole. It does not log out someone who already holds a session. Citrix's bulletin lists affected and fixed versions but, in the page we read, did not include session termination commands, and CISA's advisory does not give explicit steps either. Treat that as work for your runbook: confirm with the vendor's own guidance how to end existing sessions.

The advisory's detection tips point to things you can check in advance.

• Logs showing one session from changing IP addresses, logins from unusual locations, or one user from several public IPs.
• New accounts, remote tools such as PuTTY or rclone appearing, and commands like whoami, quser and net on hosts reached through the appliance.
• Enough log retention to look back months, since exploitation began before disclosure.

What to do

1. Build and own an inventory of internet-facing appliances with versions.
2. Subscribe the owner to vendor advisories and to the KEV catalog feed.
3. Set a written rule: known exploited and internet-facing means patch or isolate within 48 hours.
4. Write the runbook step for ending active sessions and rotating credentials of users who came through an affected appliance.
5. Alert on sessions that change IP address or geography.
6. Keep logs long enough to investigate activity that began before disclosure.
7. Run a tabletop once a year using this incident as the script.

Quick check

Sources

• CISA AA23-325A: LockBit 3.0 affiliates exploit CVE-2023-4966 (Citrix Bleed)
• Citrix security bulletin for CVE-2023-4966
• CISA Known Exploited Vulnerabilities catalog

Last reviewed: 18 October 2026.