Security News > 2023 > December > US Health Dept urges hospitals to patch critical Citrix Bleed bug

The U.S. Department of Health and Human Services warned hospitals this week to patch the critical 'Citrix Bleed' Netscaler vulnerability actively exploited in attacks.

"The Citrix Bleed vulnerability is being actively exploited, and HC3 strongly urges organizations to upgrade to prevent further damage against the Healthcare and Public Health sector. This alert contains information on attack detection and mitigation of the vulnerability," HC3 warned.

Beaumont revealed on Friday that a U.S.-based managed service provider suffered a ransomware attack by a group exploiting a Citrix Bleed vulnerability over a week ago.

In mid-November, Japanese threat researcher Yutaka Sejiyama told BleepingComputer that over 10,000 Citrix servers were still vulnerable to Citrix Bleed attacks, more than one month after the critical flaw was patched.

"This urgent warning by HC3 signifies the seriousness to the Citrix Bleed vulnerability and the urgent need to deploy the existing Citrix patches and upgrades to secure our systems," said John Riggi, a cybersecurity and risk advisor for the American Hospital Association, a healthcare industry trade group that represents 5,000 hospitals and healthcare providers across the U.S. "This situation also demonstrates the aggressiveness by which foreign ransomware gangs, primarily Russian-speaking groups, continue to target hospitals and health systems. Ransomware attacks disrupt and delay health care delivery, placing patient lives in danger."

Citrix warns admins to patch NetScaler CVE-2023-4966 bug immediately.

News URL

https://www.bleepingcomputer.com/news/security/us-health-dept-urges-hospitals-to-patch-critical-citrix-bleed-bug/