Citrix Bleed (CVE-2023-4966)

Citrix NetScaler ADC and Gateway sit at the edge of many corporate networks, handling remote access and single sign-on. Citrix Bleed is a buffer over-read: a crafted HTTP request makes the appliance return a chunk of its memory, and that memory can contain the valid session tokens of users who are already logged in.

A stolen session token is a finished login. The attacker replays it and is inside as that user, with no password and no MFA prompt. Mandiant saw exploitation from August 2023, before Citrix's fix on 10 October, and mass attacks followed a public proof of concept in late October. LockBit affiliates used it to breach a Boeing parts and distribution business, then installed remote-management tools and later leaked about 40 GB of data.

Patching was not enough on its own: sessions stolen before the update stayed valid, so Citrix and CISA told administrators to patch and then kill all active and persistent sessions. Treat edge appliances like crown jewels. Patch them within days, keep their sessions short, and alert when one session suddenly appears from somewhere new.