Citrix Bleed: Session Token Hijack (CVE-2023-4966)

A Citrix NetScaler ADC/Gateway running a vulnerable firmware version leaked an authenticated VPN session token through a heap memory disclosure flaw. An attacker captured the token from the HTTP response, replayed it to bypass MFA, and landed inside the network as a legitimate user. Reconstruct the exploit, the stolen credential, the lateral RDP move, and the post-exploitation activity from the NetScaler logs, firewall traffic, and XDR endpoint telemetry.