CitrixBleed CVE-2023-4966 (NetScaler ADC / Gateway session token leak, CISA KEV, used by LockBit): which builds are fixed, and why do I have to kill sessions after patching?

What it is: CVE-2023-4966 (CitrixBleed), disclosed October 2023, lets an unauthenticated attacker read memory from a NetScaler ADC or NetScaler Gateway appliance configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. That memory can contain valid session tokens, which let the attacker take over logged-in sessions without passwords or MFA. It was mass-exploited, including by LockBit affiliates, and is in CISA's KEV catalog. Stolen sessions survive the patch, which is why session cleanup is part of the fix. (CitrixBleed 2, CVE-2025-5777, is a separate later bug.) Am I affected: - NetScaler ADC / Gateway configured as Gateway or AAA virtual server on builds below: 14.1-8.50, 13.1-49.15, 13.0-92.19; ADC 13.1-FIPS below 13.1-37.164; 12.1-FIPS and 12.1-NDcPP below 12.1-55.300. Release 12.1 (non-FIPS) and 13.0 are end-of-life. - Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected. - Check the build with show version on the CLI or in the GUI. Fix: 1. Upgrade to a supported, current build (at minimum the fixed builds above; today, the latest supported 14.1 or 13.1 release, which also covers CitrixBleed 2 and later bugs). 2. Then end all existing sessions, as Citrix advised, so stolen tokens stop working: kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all, and clear lb persistentSessions <vServer> for each relevant virtual server. Check Citrix bulletin CTX579459 for the exact syntax on your build. 3. Hunt for misuse: look for sessions used from unexpected IPs or several IPs at once, and for follow-on activity in the internal network from VPN-assigned addresses, using the CISA and Mandiant guidance. Reset credentials for accounts whose sessions may have been hijacked. Verify: show version reports a fixed build, active session lists were cleared after the upgrade, and logs show no unexplained reuse of session IDs. Sources: https://support.citrix.com/article/CTX579459 https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed https://nvd.nist.gov/vuln/detail/CVE-2023-4966 https://www.tenable.com/blog/cve-2023-4966-citrixbleed-invalidate-sessions-to-prevent-compromise