Altumptic
Contact

ALT-49 · Analysis · 23 Oct 2026

Citrix Bleed: stealing sessions, skipping MFA

A memory leak in NetScaler appliances handed attackers valid session tokens, letting them skip passwords and multi-factor checks entirely. Why patching was not enough.

Timeline
  1. Late Aug 2023Exploitation begins, according to Mandiant.
  2. 10 Oct 2023Citrix publishes the fix.
  3. 21 Nov 2023CISA and partners publish an advisory on LockBit 3.0 affiliates exploiting it.

Why patching was not enough

A patch stops new leaks, but tokens already stolen keep working. The guidance was to patch and then kill every active and persistent session — a step many organisations missed at first.

Our reading

Analysis — Altumptic's interpretation of the sources below.

  • A session token is a password that skips MFA; protect it as one.
  • Incident response for memory-disclosure bugs always includes revoking what might have leaked.
  • Edge appliances are the most targeted systems in most networks.

What to do

  1. After patching a memory-disclosure flaw, terminate all sessions and rotate secrets.
  2. Bind sessions to device or client properties where the product allows it.
  3. Keep remote-access appliances on an emergency patch track.

Sources

  1. CISA — LockBit 3.0 affiliates exploit Citrix Bleed (AA23-325A)
  2. NVD — CVE-2023-4966

Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.

Cite this entry

Altumptic Lab (2026). ALT-49 — Citrix Bleed: stealing sessions, skipping MFA. 23 Oct 2026. altumptic.com/research/citrix-bleed-2023