Citrix Bleed: patch, then kill the sessions
The NetScaler bug leaks session tokens. If you patched without ending sessions, attackers may still be logged in.
Citrix Bleed (CVE-2023-4966) affects NetScaler ADC and Gateway. A request to the device makes it leak memory that contains valid session tokens. With a token, an attacker takes over a logged-in session, MFA already done.
The patch came out on 10 October. Since then, mass exploitation has started, and some attacks began weeks before the patch.
The catch: patching stops new leaks, but tokens already stolen keep working. So:
- Patch to the fixed version now.
- Then end every active and persistent session. Citrix lists the exact commands in its advisory. Everyone logs in again, and stolen tokens die.
- Look back at sessions from unusual IPs or with sudden IP changes since August.
- If you find signs of misuse, treat the internal systems those users could reach as possibly compromised.
Remote access gateways are a favourite target. Any time one leaks sessions, “patch and move on” leaves the door half open.