Citrix Bleed: How a Memory Leak in NetScaler Bypassed MFA Entirely

Multi-factor authentication is supposed to be the backstop that makes stolen passwords not enough. CVE-2023-4966 — better known by its nickname, Citrix Bleed — demonstrated a category of flaw that skips the password-and-MFA problem entirely: it steals an already-authenticated session.

How the bug works, at a high level

Citrix Bleed is a buffer-overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances configured as a gateway — VPN virtual server, ICA proxy, CVPN, or RDP proxy — or as an AAA virtual server. Exploiting it lets a remote, unauthenticated attacker retrieve data directly from the device’s memory, including valid session tokens belonging to legitimate, already-logged-in users.

Because those tokens represent sessions that have already cleared authentication and MFA, an attacker who captures one can simply present it to the appliance and be treated as that user — no credentials, no second factor, no password reset required. It’s session hijacking with the authentication step already completed by someone else.

Exploitation in the wild

Citrix disclosed CVE-2023-4966 on October 10, 2023. Mandiant later reported that exploitation had begun even before the public disclosure, and that ransomware-affiliated actors, including groups linked to LockBit, used the flaw to compromise large enterprises — among the most notable publicly reported victims was a major financial-sector firm whose breach was directly tied to Citrix Bleed exploitation. CVE-2023-4966 was added to CISA’s KEV catalog in November 2023.

The patching trap that made this worse

What made Citrix Bleed especially dangerous operationally: patching the appliance alone was not sufficient. Session tokens stolen before the patch was applied remained valid afterward, because the patch fixed the vulnerability going forward but did nothing to invalidate sessions already hijacked. Citrix’s guidance — and CISA’s — was explicit that administrators needed to kill all active ICA and PCoIP sessions after patching, not just apply the update and move on.

Why it mattered

Citrix Bleed is a clean illustration of why “we have MFA” is not a complete security story. Token-theft and session-hijacking vulnerabilities sidestep authentication controls entirely, and they’re increasingly the technique of choice for sophisticated ransomware affiliates who’d rather steal a valid session than guess a password.

Full technical detail, affected build numbers, and remediation steps are published in Citrix’s own security bulletin and the NVD record.

This article describes the vulnerability and its real-world impact only — it does not include exploit code or step-by-step attack instructions.