Citrix Bleed (CVE-2023-4966)

On November 8, 2023, ICBC Financial Services, the U.S. arm of the Chinese bank ICBC, was crippled by ransomware, and some U.S. Treasury trades failed to settle on time. Boeing had been hit in late October; DP World Australia followed in November. The entry point cited for these attacks was Citrix Bleed, CVE-2023-4966, disclosed on October 10, 2023. NetScaler ADC and Gateway appliances, used as remote access gateways, let an attacker read part of their memory, and with it valid session tokens. With a token, the attacker takes over a session already open: no password, no second factor, since multifactor authentication has already happened. LockBit affiliates made it their way in. For an underwriter the lesson fits in one sentence: patching was not enough. A company that applied the fix without killing active sessions left stolen tokens in place, and could be breached after patching. The application question “do you apply critical patches within X days?” misses this case; the useful question is about the procedure after the patch. The second point is accumulation: one appliance model, exposed to the internet at thousands of insureds, opens a run of losses across a book with no coordinated attack behind it. Not to be confused with a zero-day: Citrix Bleed was exploited at scale after disclosure and after the fix shipped; the failure lay in how the fix was applied rather than in its absence.