Case study: Citrix Bleed (CVE-2023-4966)

NetScaler ADC and NetScaler Gateway, sold by Citrix and now by Cloud Software Group, are appliances that front remote access: VPNs, Citrix virtual desktops and other internal applications. On 10 October 2023 the vendor released fixes for CVE-2023-4966, a 'sensitive information disclosure' flaw classed as CWE-119 that its internal team had found. It affected appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; the vendor scored it CVSS 9.4 (NVD's own score is 7.5) and said there was no workaround.

The information it disclosed was memory, and the memory held session cookies. CISA's advisory AA23-325A describes attackers 'sending an HTTP GET request with a crafted HTTP Host header, leading to a vulnerable appliance returning system memory information' that contained a valid NetScaler AAA session cookie. With it, they could 'establish an authenticated session within the NetScaler appliance without a username, password, or access to MFA tokens.' The vulnerability came to be called Citrix Bleed; CISA's advisory uses the name.

Exploitation had started before the fix. The vendor reports that Mandiant found zero-day exploitation beginning in late August 2023, and CISA dates exploitation activity 'as early as August 2023'. Patching stopped new leaks, but every cookie stolen before the patch kept working, which is why the vendor's follow-up guidance told customers to kill all sessions.

Citrix has kept technical details to the bulletin, so the public primary record of the mechanism is CISA's description: a crafted Host header in a GET request made the appliance return memory beyond what it should have, and that memory could contain the AAA session cookie of a user who was already signed in. No memory was written and no code was run on the appliance; the attacker simply read a credential.

That credential was the whole of the user's authentication. Once a user had passed the password and MFA checks, the cookie alone represented the session, so 'MFA to NetScaler will not operate as intended due to the attacker bypassing authentication by providing a token/session for an already authenticated user', as CISA puts it. From the gateway session, affiliates moved to virtual desktops and the internal network, and CISA lists the remote management tools, scripts and credential dumping that followed.

Two design facts combined. Request handling in a memory-unsafe language could return bytes it should not, and the most valuable bytes nearby were bearer tokens that worked from anywhere. The C and C++ memory-safety guide (/domains/appsec/platform-security/memory-safety-c-cpp/) covers the first, and the session guide (/domains/identity-crypto/authentication/session-lifecycle/) the second.

A patch changes what the appliance does with the next request. It does nothing to sessions an attacker already holds. On 23 October 2023 the vendor reported 'incidents consistent with session hijacking' and recommended that customers, after installing the fixed builds, kill 'all active and persistent sessions' with five commands that terminate ICA, RDP and PCoIP connections, end AAA sessions and clear load-balancing persistence. CISA's advisory goes further for appliances that may already have been used: isolate them until patched, hunt for activity in sessions, and if compromise is found 'assume that threat actors hold full administrative access', reimage hosts and issue new credentials.

The lesson for anyone who writes advisories is that the remediation for a credential-leaking flaw has two halves, and the second half has to be in the first advisory. The lesson for anyone who builds authentication is that revoking every session must be a capability that exists, is fast, and has been tested. ASVS 5.0 requirement V7.4.5 asks that administrators can 'terminate active sessions for an individual user or for all users.'

On 17 June 2025 Citrix published bulletin CTX693420 for CVE-2025-5777, 'Insufficient input validation leading to memory overread', on the same configurations: NetScaler as a Gateway or AAA virtual server. It scored CVSS 4.0 9.3, was fixed in 14.1-43.56 and 13.1-58.32 and later (with FIPS and NDcPP builds), and the bulletin recorded that versions 12.1 and 13.0 were end of life and no longer supported. Its advice again included killing sessions: after all appliances in the HA pair or cluster are upgraded, run kill icaconnection -all and kill pcoipConnection -all. Third-party researchers nicknamed it CitrixBleed 2.

CISA added CVE-2025-5777 to the KEV catalog on 10 July 2025 with a one-day remediation deadline for federal agencies, and the catalog now marks it as used in ransomware campaigns. The bulletin's change history does not record exploitation. The same class of bug, on the same internet-facing code path, leaked the same class of secret twenty months later; root-cause work that ends at the one bug, rather than the class, leaves room for the next one.

The script takes one version per line, in the 13.1-49.15 form the bulletin uses or the NS13.1: Build 49.15 form, and reports whether each build is below the CVE-2023-4966 fix for its branch, flags end-of-life branches, and sends FIPS and NDcPP builds to the bulletin's own rows rather than guessing. It ran with Python 3.14 on a sample list. Treat it as one input to an inventory: a build fixed for 2023 can still be vulnerable to later bulletins such as CTX693420, and a version string says nothing about sessions already stolen.

"""Flag NetScaler ADC and Gateway builds below the CVE-2023-4966 fixes.

Input: one version per line, as "13.1-49.13" or "NS13.1: Build 49.13".
Fixed builds from Citrix bulletin CTX579459 (standard releases only).
A fixed build for CVE-2023-4966 can still be vulnerable to later bulletins.
"""
import re
import sys

FIXED = {"14.1": (8, 50), "13.1": (49, 15), "13.0": (92, 19)}
END_OF_LIFE = {"12.1", "13.0"}  # 13.0 reached end of life after this fix
PATTERN = re.compile(r"(?:NS)?(\d+\.\d+)(?::\s*Build\s+|-)(\d+)\.(\d+)")


def status(line):
    if re.search(r"FIPS|NDcPP", line, re.I):
        return "check the FIPS/NDcPP rows of the bulletin"
    match = PATTERN.search(line)
    if not match:
        return "unrecognized version string"
    branch, build = match[1], (int(match[2]), int(match[3]))
    if branch not in FIXED:
        return f"{branch} has no fix: end of life, replace it"
    verdict = "VULNERABLE" if build < FIXED[branch] else "fixed for CVE-2023-4966"
    eol = "; branch is end of life, upgrade to a supported one" if branch in END_OF_LIFE else ""
    return verdict + eol


if __name__ == "__main__":
    for line in sys.stdin:
        if line.strip():
            print(f"{line.strip()}: {status(line)}")

These are the vendor's commands from 23 October 2023, run on the NetScaler command line after the fixed build is installed on every appliance. The vendor's note asks that the formatting stay intact when they are copied. For CVE-2025-5777 the bulletin lists the first and third commands, to run after every appliance in the HA pair or cluster is upgraded. Then hunt: users will have to sign in again, and any session that reappears without a fresh sign-in is worth investigating.

# 1. Install the fixed build on every appliance first (HA pairs and clusters too).
# 2. Then end every session that might rest on a stolen cookie:
kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
kill aaa session -all
clear lb persistentSessions

• When a flaw can leak credentials, the fix is patch plus revocation. Put both in the first advisory.
• A session cookie that works from anywhere turns any memory disclosure into an account takeover; bind and shorten sessions on remote-access paths.
• Make 'end every session now' a tested feature of anything you build that issues sessions.
• Internet-facing parsing in C needs fuzzing, bounds checks and a plan to move to memory-safe code; the same bug class returned in 2025.
• Edge devices are prime targets. Patch KEV entries on them in days, then hunt in the sessions, not just the logs.

Citrix has not published the vulnerable code path, and the vendor says it is 'limiting information to the details contained in its security bulletin'; mechanism details beyond CISA's description come from third-party research. The public record does not give a count of exploited appliances or affected organizations. The start of exploitation in late August 2023 comes from Mandiant's investigations as relayed by the vendor. A build number shows whether an appliance is patched, not whether its sessions were stolen before the patch. For CVE-2025-5777, exploitation is recorded by CISA's KEV catalog, not by the Citrix bulletin, and the nickname CitrixBleed 2 is third-party usage.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. Citrix CTX579459: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2023-4966 and CVE-2023-4967. Published 10 October 2023, updated through 15 July 2024.
2. NetScaler blog: CVE-2023-4966, critical security update now available for NetScaler ADC and NetScaler Gateway. 23 October 2023.
3. CISA AA23-325A: LockBit 3.0 ransomware affiliates exploit CVE-2023-4966 Citrix Bleed vulnerability. 21 November 2023.
4. CISA Known Exploited Vulnerabilities catalog (CVE-2023-4966 and CVE-2025-5777). Catalog version 2026.10.08.
5. Citrix CTX693420: NetScaler ADC and NetScaler Gateway security bulletin for CVE-2025-5349 and CVE-2025-5777. Published 17 June 2025.
6. NVD: CVE-2023-4966
7. OWASP ASVS 5.0.0: V7 Session Management. Version 5.0.0.

Reference information

Tags

Memory safetyAccount takeoverAuthentication and sessionsVulnerability management

SDLC phase

Maintenance

Role

DevelopersAppSec engineers

ASVS 5.0.0 requirements

v5.0.0-7.4.5

CAPEC attack patterns

• CAPEC-593 at MITRE

Download this guide as Markdown

Continue exploring