Tag

#citrix

2 posts tagged #citrix.

Analysis · May 20, 2026 · Colten Anderson

CitrixBleed: the patch closed the leak but left the stolen keys working

CVE-2023-4966 leaked post-MFA session tokens from NetScaler. Organizations that patched and stopped there got breached anyway, because a stolen token still worked after the update. The action that mattered was killing every active session, and a lot of victims skipped it.
Analysis · May 6, 2026 · Colten Anderson

Citrix shipped CitrixBleed again

Citrix shipped the same pre-auth memory disclosure bug class it patched in 2023. Same binary, same attack surface, same session token leakage. Its own post-patch guidance still doesn't invalidate the tokens attackers actually steal.