NetScaler® Post-Patch Checklist: CitrixBleed Session Kills

CitrixBleed (CVE-2023-4966) and the bug widely nicknamed CitrixBleed 2 (CVE-2025-5777) are both memory-disclosure flaws. They affect NetScaler appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server (CTX579459, CTX693420). CISA lists both in the KEV catalog with known ransomware use.

The upgrade closes the leak. It does nothing to session tokens that were already read out of memory before you patched. That is why the vendor tells you to terminate sessions after upgrading. For CVE-2023-4966, CISA's KEV entry goes further and sets the required action as "Apply mitigations and kill all active and persistent sessions per vendor instructions."

This checklist covers which CVEs need a session kill, the exact commands from primary sources, the order to do things in, and what to do afterwards.

Why patching alone doesn't end it

For CVE-2023-4966, NetScaler reported "incidents consistent with session hijacking" and described the impact as "unauthorized data disclosure and possibly session hijacking" (NetScaler blog). The joint CISA advisory on LockBit's use of the bug notes that MFA "will not operate as intended due to the attacker bypassing authentication" (AA23-325A). A replayed session never goes back through the logon flow.

For CVE-2025-5777, NetScaler is more cautious: "Session theft is plausible but not guaranteed" (NetScaler blog).

Either way, the risk is the same. A token copied before the patch still identifies a live session on the patched appliance. Terminating sessions invalidates those tokens and forces every user back through authentication and MFA.

Which CVEs call for a session kill?

This is what each bulletin said when we checked them on 15 October 2026. Bulletins get updated, so re-read yours.

The checklist

Step 1: Decide on evidence collection before you change anything

If you suspect compromise, or you fall under CISA's BOD 26-04, collect evidence first. CISA's implementation guidance warns that "patching may jeopardize the availability of artifacts" (BOD 26-04 guidance). Killing sessions also clears the live session table.

CTX694799 lists what to preserve:

• a VPX snapshot
• system time, timezone and NTP settings
• remote syslog and NetScaler Console logs
• a support bundle
• an NSPPE core dump (taking it triggers a warm restart)

For CVE-2025-5777 specifically, NetScaler says exporting a list of active sessions before killing them "isn't recommended".

Step 2: Patch every node and confirm the build

Upgrade the secondary, fail over, then upgrade the other node. Our HA pair upgrade guide covers the full procedure. Then run these on each node:

show ns version
show ha node

The minimum fixed builds:

• CVE-2023-4966: 14.1-8.50, 13.1-49.15 and 13.0-92.19.
• CVE-2025-5777: 14.1-43.56 and 13.1-58.32.
• FIPS/NDcPP: these have their own fixed builds, listed in each bulletin.

In practice you'll be going to the latest fixed build anyway, because the 2026 bulletins raised the floor again.

Step 3: Kill sessions on the primary

Run these once all nodes are on the fixed build. Run them on the node that is currently primary, because that is where the sessions live.

CVE-2023-4966, as given in NetScaler's post-upgrade guidance:

kill aaa session -all
kill icaconnection -all
kill rdp connection -all
kill pcoipConnection -all
clear lb persistentSessions

CVE-2025-5777, as given in CTX693420:

kill icaconnection -all
kill pcoipConnection -all

Some notes on these commands:

• NetScaler asks you to keep the formatting intact when pasting.
• The CLI reference documents the long forms kill vpn icaConnection, kill rdp connections and kill vpn pcoipConnection. Its own examples use the short forms (ICA, RDP, PCoIP).
• kill aaa session -all terminates every AAA-TM/VPN session (aaa-session).
• clear lb persistentSessions with no virtual server named flushes all persistence sessions (lb-persistentSessions).
• Running the full 2023 set after a CVE-2025-5777 patch goes beyond what CTX693420 asks for. It also logs off every VPN, clientless and RDP-proxy user. Make that a deliberate decision, not a copy-paste.

Afterwards, run show aaa session and show vpn icaConnection. They should list only users who have reconnected since the kill.

Step 4: Tell users before you do it

Anyone connected through the Gateway loses their connection: HDX/ICA users, and with the 2023 set also VPN, clientless and RDP-proxy users. They will have to log on again, including MFA.

Send a short notice to users that covers:

• when it will happen
• that the disconnect is expected
• that their session will reconnect after they log on again

Also give the service desk a heads-up so a spike in "my session dropped" tickets isn't escalated as an outage. Schedule the kill straight after the second node passes validation. Don't hold back a KEV fix to wait for a quieter time.

Step 5: Hunt for indicators

CVE-2023-4966 (NetScaler investigation recommendations):

• Look for suspicious session use in your monitoring tools, especially around virtual desktops.
• Look for SSLVPN TCPCONNSTAT log lines where Client_ip and Source don't match. Roaming users can legitimately cause this.
• Look for the same Source IP using sessions belonging to several users.
• NSPPE memory snapshots from an unpatched instance need at least 5 GB free. Clear /var/core afterwards.

CVE-2025-5777 (NetScaler log guidance). Run this in /var/log on MPX/VPX:

zcat ns.log.*.gz | awk -v FS='Authentication is rejected for ' '{if($1~/AAA Message/&&$2~/[\x80-\xff]/) print}'

Non-ASCII bytes in those lines can indicate exploit attempts. Local logs may only go back a few days, so search your syslog store as well. NetScaler also warns that these checks won't catch every exploit.

From CISA (AA23-325A):

• users tied to two or more public IP addresses
• suspicious logon patterns in NetScaler logs
• WAF requests to the HTTP/S endpoint
• post-access commands such as hostname, quser, whoami, net and taskkill
• AnyDesk or Splashtop appearing unexpectedly

NetScaler Console's file integrity monitoring can show whether NetScaler build files have been changed (NetScaler blog).

Step 6: Rotate credentials where the evidence points

CISA recommends "Rotating credentials for identities provisioned for accessing resources via a vulnerable NetScaler ADC or Gateway appliance".

If you suspect compromise, CTX694799 goes further:

• Change service-account secrets stored on the NetScaler: LDAP binds, RADIUS shared secrets, OAuth tokens, API keys and SNMP community strings.
• Change passwords for users who authenticated through it.
• Revoke its certificates.
• Rebuild the appliance and upgrade it before restoring a backup that pre-dates the compromise.
• Rotate the KEK and local passwords.
• Monitor the appliance for at least 90 days.

Step 7: Re-check KEV and the bulletin

Pull the KEV feed and re-read the bulletin before you close the change. Since March 2026, NetScaler has published its CVE disclosure blogs in the Security Updates section of the Citrix® Community site, while the CTX bulletins stay on support.citrix.com (NetScaler blog). Read both. Fixes get superseded. 14.1-73.37 fixed CVE-2026-88771 and -88772, but eight days later CVE-2026-88779 needed 14.1-73.41. Paste your show ns version output into the build checker to see where you stand.

Step 8: Document it for audit

Record the following for each node:

• the build before and after the upgrade
• the bulletin IDs
• the change and approval references
• when each node was upgraded
• the exact kill commands, with their timestamps and output
• the user comms you sent
• the IOC queries you ran and their results
• any credentials you rotated

If you're in scope for BOD 26-04, CISA expects a forensic triage report covering the timeline, actions taken, findings, containment and next steps. Confirmed compromise is reported to CISA.

FAQ

Do I need to kill sessions after every NetScaler patch?

No, only when the vendor or CISA says so. NetScaler states it isn't required for CVE-2025-6543.

What's the difference between CitrixBleed and CitrixBleed 2?

They are separate CVEs with separate fixed builds. Both are memory disclosures in Gateway/AAA configurations. NetScaler says it has found no evidence linking them, although the mitigations are similar.

Where are the CitrixBleed 2 IOCs?

In NetScaler's July 2025 log-evaluation post, which includes the awk search and the session-IP comparison.

How do I kill one user's AAA session?

Run kill aaa session -userName <user>. The command also accepts -groupName, -intranetIP and -sessionKey.

Want a second pair of eyes?

Paste your show ns version output into the free NetScaler build and CVE checker. It runs in your browser, scans nothing, and maps your build to the bulletins, fixed builds and KEV status. Sessionwright's Nightpatch Gateway patch workflow can run the patch, verify and session-kill sequence as a plan you approve. It is read-only by default, and every command is approved and logged.

Sources

• Citrix: CTX579459, security bulletin for CVE-2023-4966 and CVE-2023-4967
• Citrix: CTX693420, security bulletin for CVE-2025-5349 and CVE-2025-5777
• Citrix: CTX694788, security bulletin for CVE-2025-6543
• Citrix: CTX696300, security bulletin for CVE-2026-3055 and CVE-2026-4368
• Citrix: CTX697096, security bulletin for CVE-2026-88771 to CVE-2026-88778
• Citrix: CTX697174, security bulletin for CVE-2026-88779
• Citrix: CTX694799, Steps to take if NetScaler ADC is suspected to be compromised
• NetScaler blog: CVE-2023-4966: Critical security update now available
• NetScaler blog: NetScaler investigation recommendations for CVE-2023-4966
• NetScaler blog: NetScaler Critical Security Updates for CVE-2025-6543 and CVE-2025-5777
• NetScaler blog: Evaluating NetScaler logs for indicators of attempted exploitation of CVE-2025-5777
• NetScaler CLI reference: aaa-session, vpn-icaConnection, rdp-connections, vpn-pcoipConnection, lb-persistentSessions, ns-version
• NetScaler blog: Important Update: CVE Disclosures Now Live on the Citrix Community Site
• CISA: Known Exploited Vulnerabilities catalog (JSON feed)
• CISA: Guidance for Addressing Citrix NetScaler ADC and Gateway Vulnerability CVE-2023-4966, Citrix Bleed
• CISA: AA23-325A, LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability
• CISA: BOD 26-04 implementation guidance