The U.S. Department of Health and Human Services (HHS) is urging hospitals and healthcare facilities to patch an actively exploited critical vulnerability in Citrix Netscaler ADC and Netscaler Gateway known as Citrix Bleed. Netscaler monitors server health and optimizes resource utilization by allocating network and application traffic to adjacent servers. The flaw, tracked as CVE-2023-4966, is a sensitive information disclosure vulnerability affecting appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA server. The flaw is already being exploited by ransomware actors to bypass password requirements and multifactor authentication (MFA), allowing for successful session hijacking of legitimate user sessions on Citrix NetScaler ADC and Gateway appliances. Currently, thousands of Citrix servers are vulnerable to exploitation, and many may have already been compromised. Although this flaw was patched in October 2023, it has been exploited by threat actors as a zero-day since at least August 2023. Center (HC3) team, the Health Sector Cybersecurity Coordination Center (HC3), has issued an urgent sector alert informing customers that they must immediately apply patches and upgrades to their systems to prevent exploitation. Multiple threat groups have already been identified as exploiting Citrix Bleed, and The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory report warning that the flaw is already being exploited by threat actors leveraging the Lockbit 3.0 ransomware. CTIX analysts recommend that any administrators responsible for the affected appliances follow the patching and mitigation instructions in the HC3 alert linked below. Within the alert are also instructions for how healthcare organizations can investigate their networks to identify any indicators of compromise (IOCs) that may suggest their network has been compromised.