News
Vulnerability · Global · October 2023
Citrix Bleed in NetScaler ADC and Gateway (CVE-2023-4966)
A memory disclosure flaw allowed attackers to steal session tokens from NetScaler appliances and bypass multifactor authentication.
Incident
What happened
The vulnerability leaked memory contents, including valid session tokens, from NetScaler ADC and Gateway appliances.
Stolen sessions let attackers take over authenticated sessions without passwords or MFA.
Ransomware groups used the flaw to gain initial access to corporate networks.
Analysis
Lessons learned
Patching alone is insufficient; existing sessions must be terminated after remediation.
Remote access gateways sit on the perimeter and require continuous attention.
MFA must be complemented by session management and monitoring.
Prevention
How penetration testing helps
External network penetration testing assesses perimeter devices, VPN and gateway exposure, and session handling.
Sources
Summary based on publicly available information. DIGITPOL HK was not involved in this incident.