{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "session-hijacking",
    "label": "Session Hijacking",
    "isStack": false,
    "url": "https://pwn.watch/t/session-hijacking",
    "feed": "https://pwn.watch/t/session-hijacking/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "citrix-bleed-netscaler-cve-2023-4966",
      "title": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966",
      "json": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Citrix NetScaler ADC and NetScaler Gateway",
      "tags": [
        "citrix",
        "netscaler",
        "zero-day",
        "session-hijacking",
        "lockbit",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-4966"
      ],
      "affectedVersions": [
        "NetScaler ADC and Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (NVD); exact builds: see vendor advisory"
      ],
      "fixedVersions": [
        "14.1-8.50",
        "13.1-49.15",
        "13.0-92.19",
        "FIPS/NDcPP builds: see vendor advisory"
      ],
      "startedAt": "2023-10-10",
      "closedAt": "2023-11-21",
      "updatedAt": "2023-12-18",
      "summary": "A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).",
      "xPost": null
    },
    {
      "slug": "okta-support-system-breach-2023",
      "title": "Okta support system breach: HAR files with session tokens stolen",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023",
      "json": "https://pwn.watch/i/okta-support-system-breach-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Okta Help Center (customer support system)",
      "tags": [
        "okta",
        "beyondtrust",
        "cloudflare",
        "1password",
        "identity",
        "session-hijacking",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-09-28",
      "closedAt": "2023-11-29",
      "updatedAt": "2023-11-29",
      "summary": "An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-18",
      "title": "Xfinity discloses that Citrix Bleed exploitation on Oct 16–19 exposed data on 35.9M customers",
      "body": null,
      "sourceUrl": "https://www.theverge.com/2023/12/18/24007082/xfinity-data-breach-hack-notice-citrix",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-29",
      "title": "Okta: the attacker downloaded the names and email addresses of all customer support system users",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-21",
      "title": "CISA, FBI, MS-ISAC and ACSC warn that LockBit 3.0 affiliates are exploiting Citrix Bleed (AA23-325A)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-11-03",
      "title": "Okta root cause: the service account's password was saved in an employee's personal Google profile; 134 customers' files accessed, 5 sessions hijacked",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-23",
      "title": "Citrix issues additional mitigation guidance",
      "body": null,
      "sourceUrl": "https://assets.xfinity.com/assets/dotcom/learn/Notice%20To%20Customers%20of%20Data%20Security%20Incident.pdf",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-19",
      "title": "Okta notifies customers of the security incident",
      "body": null,
      "sourceUrl": "https://sec.okta.com/harfiles",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "CISA adds CVE-2023-4966 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-18",
      "title": "Cloudflare detects attackers pivoting into its Okta instance with a token stolen from Okta",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-17",
      "title": "Mandiant reports zero-day exploitation since late August 2023 and session hijacking that survives patching",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/session-hijacking-citrix-cve-2023-4966",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "citrix-bleed-netscaler-cve-2023-4966",
      "incidentTitle": "Citrix Bleed: NetScaler session token leak (CVE-2023-4966)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Citrix publishes bulletin CTX579459 and fixed builds",
      "body": null,
      "sourceUrl": "https://support.citrix.com/external/article/CTX579459/netscaler-adc-and-netscaler-gateway-secu.html",
      "url": "https://pwn.watch/i/citrix-bleed-netscaler-cve-2023-4966"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-10-02",
      "title": "BeyondTrust detects an attacker using a session cookie from a HAR file it uploaded to Okta support and reports it to Okta",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/blog/entry/okta-support-unit-breach",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    },
    {
      "incident": "okta-support-system-breach-2023",
      "incidentTitle": "Okta support system breach: HAR files with session tokens stolen",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-09-28",
      "title": "Attacker access to Okta's support system begins; a report of all support users is run at 15:06 UTC",
      "body": null,
      "sourceUrl": "https://sec.okta.com/articles/october-security-incident-recommended-actions/",
      "url": "https://pwn.watch/i/okta-support-system-breach-2023"
    }
  ]
}