The patch closes the leak going forward. The credential disclosure already happened. Citrix's own remediation guidance does not invalidate the cookies the bug leaked.

Most patch records close the row when the version number on the appliance changes. The change record names the fix version, the SI-2 narrative names the change record, the QSA reads the narrative, the audit form rolls up. The model assumes that fixing the binary closes the exposure. For most bugs the model is approximately right. Credential-disclosure bugs break the model in a specific way: the binary patch closes the leak going forward, and the credentials that already leaked do not stop being valid because the leak stopped. The patched session and the leaked session both authenticate against the same cookie store, and the cookie store does not know which session is which.

Citrix Security Bulletin CTX693420 lists the fix versions per branch and names two post-patch commands: kill icaconnection -all and kill pcoipConnection -all. Horizon3.ai’s reverse-engineering writeup verified what the operator community already suspected by late June: those two commands do not invalidate the NSC_AAAC authentication cookies the bug actually returns in the leaked memory. The vendor advisory’s remediation list stops one command short of the remediation the bug requires. The complete remediation runbook exists — Mandiant published it on November 14, 2023 against the original CitrixBleed (CVE-2023-4966) — and the operator community has circulated it for two years. CTX693420 does not reference the 2023 Mandiant guidance. The advisory reads complete; the advisory is partial.

The structural problem is not that vendor advisories are sometimes incomplete. It is that audit infrastructure reads the vendor advisory as the authoritative remediation specification. PCI Requirement 6.3.3 writes a one-month patch clock against the advisory date and a binary patched/unpatched cell against the change record. The cell does not have a sub-field for “operator went beyond the vendor’s instructions.” The FedRAMP SI-2 narrative writes against the version-number change. The version number is the same whether the operator rotated the NSC_AAAC cookies, rebooted the appliance, killed the AAA sessions, and rotated the SAML or OIDC tokens against the downstream IdP, or just applied the patch and called it done. The two operators read identical on the audit form. They do not read identical to the adversary holding a stolen token.

The two-year recurrence is the thing the editorial corpus keeps arriving at. CitrixBleed 1 in 2023 had the same gap. Mandiant documented it. Cloud Software Group signed CISA’s Secure by Design pledge in 2024. Citrix shipped CitrixBleed 2 in 2025 with the same incomplete post-patch instructions, against approximately the same endpoint class, in approximately the same binary. The vendor advisory field that says “remediation steps” carries the same shape and the same omission. The change-record field on the operator side carries the same shape and the same closure. What changed is the count of exposed session tokens that the operator is now responsible for invalidating, and the audit infrastructure does not have a column for that count. It has a column for the version number on the appliance, and the version number is in compliance.

The narrow operational instruction is short: patch to the per-branch fix version, and then do the steps the vendor advisory does not list — full appliance reboot to force session teardown, NSC_AAAC cookie invalidation, downstream IdP token rotation against every service the NetScaler fronted, and incident-response treatment for any session active during the exposure window (mid-June 2025 onward, earlier if your telemetry can confirm it). The wider observation is what the audit form does with the gap between the published advisory and the complete remediation. The form reads the advisory and writes a binary cell. The complete remediation lives outside the cell. The operator who closes the cell and stops there is the audience the next ransomware campaign is for.