That's right. Of course, without knowing more details about the vulnerability, it's hard to say whether there's a benefit to ending the session.