“Mandiant cautioned that compromised sessions persist even after patching and, depending on the compromised accounts’ permissions, attackers could move laterally across the network or compromise other accounts.”
Citrix rated the flaw 9.4 and shipped a fix with no evidence of attacks. Mandiant found it had already been used as a zero-day to steal sessions and walk past MFA at government agencies and tech companies. Citrix now admits it cannot help customers tell whether they were breached. Patching a NetScaler locks the door after the burglar already has a key.