Citrix Bleed (CVE-2023-4966) is a memory disclosure flaw in NetScaler ADC and Gateway that let attackers read valid session tokens and bypass passwords and MFA. Exploitation began before the 10 October 2023 fix. The lesson: patching is not enough, you must also end sessions that may already be stolen.
What happened, in dates?
- August 2023. CISA's advisory says exploitation activity was first identified in August 2023, and SecurityWeek describes the flaw as exploited as a zero-day since August.
- 10 October 2023. Citrix published security bulletin CTX579459 with fixed versions. The bulletin says exploits on unmitigated appliances had been observed.
- 18 October 2023. CISA added CVE-2023-4966 to its Known Exploited Vulnerabilities catalog, with a due date of 8 November 2023 for federal agencies. The catalog notes known ransomware campaign use.
- 21 November 2023. CISA published advisory AA23-325A on LockBit 3.0 affiliates exploiting the flaw. It names Boeing Distribution Inc. as one place where initial access was observed.
What was the flaw?
The Citrix bulletin describes sensitive information disclosure from a buffer related flaw, rated CWE-119 in the KEV record. It applied only when the appliance was configured as a gateway (VPN virtual server, ICA proxy, CVPN or RDP proxy) or as an authentication virtual server. Affected branches included 14.1 before 14.1-8.50, 13.1 before 13.1-49.15 and 13.0 before 13.0-92.19, plus certain FIPS and NDcPP builds. Version 12.1 was end of life and vulnerable.
CISA's advisory describes how attackers used it. A crafted HTTP GET request with a malicious Host header made the appliance return memory containing a valid session cookie. With that cookie, the attacker obtained authenticated access without a username, password or MFA token, and hijacked legitimate sessions.
Why did patching not end the problem?
A session token is a bearer credential. Once stolen, it stays useful until the session ends, and the patch does not end sessions on its own. CISA's KEV entry therefore says to apply mitigations and kill all active and persistent sessions per vendor instructions, or stop using the product if mitigations are unavailable. SecurityWeek reports that persistent sessions can leave patched instances at risk, and quotes Mandiant saying NetScaler does not log requests associated with the bug, so hunting relies on WAFs or other network appliances that record HTTP requests.
The CISA advisory also warns that deleting malicious accounts may not remove the risk, because attackers may have set up other persistence. It advises assuming full administrative access if compromise is suspected, then isolating and reimaging hosts and creating new credentials.
What did attackers do afterwards?
The advisory lists credential harvesting, lateral movement, dumping of LSASS memory, use of legitimate remote management tools such as AnyDesk, Splashtop, ScreenConnect and Zoho Assist, and tools like Mimikatz. Those are ordinary administrative tools, which is why allowlisting remote access software is among CISA's mitigations.
What should defenders learn?
- Internet facing remote access appliances are high value targets. Put them first in your patch order.
- After patching a session theft flaw, invalidate sessions, rotate credentials used through the appliance and hunt for persistence.
- Know where your appliances log, and whether they log the events that matter. Gaps push you to firewall and network logs.
- Treat vendor end of life notices as deadlines. Version 12.1 had no fix.
- Prefer phishing resistant MFA and short session lifetimes, which limit what a stolen token is worth.
- Use KEV as an input. Citrix Bleed was listed eight days after the bulletin, and CISA's guidance asked for patching within 24 to 48 hours for known exploited flaws on internet facing systems.
What to do now
- Confirm no NetScaler appliance runs a version below the fixed builds, and replace end of life versions.
- Check that you have a written procedure for ending all sessions on remote access gateways.
- Review whether your vulnerability process flags KEV entries on internet facing assets as urgent.
- Keep your asset list current so you can answer "do we run this" in minutes.
Quick check
Did patching alone remove the attacker?
No. Stolen session tokens could remain valid, so CISA's KEV entry requires killing active and persistent sessions as well as applying the update.
Was it exploited before the fix?
Yes. CISA's advisory says exploitation was first identified in August 2023, and the Citrix bulletin of 10 October 2023 followed.
Sources
- CISA, AA23-325A, LockBit 3.0 affiliates exploit CVE-2023-4966
- Citrix, Security bulletin CTX579459
- CISA, Known Exploited Vulnerabilities catalog data (JSON feed, fetched 18 October 2026)
- SecurityWeek, Mass exploitation of Citrix Bleed vulnerability underway
Last reviewed: 18 October 2026.
