Loading story…
Attackers continued to target Citrix NetScaler ADC and NetScaler Gateway systems vulnerable to CVE-2025-5777, a critical flaw also dubbed Citrix Bleed 2 that can let unauthenticated attackers obtain sensitive information and hijack user sessions. The vulnerability affects NetScaler deployments configured as described in Citrix’s security bulletin, and public advisories warned that exploitation could also enable arbitrary file reads, broader information disclosure, and denial of service on exposed appliances.
SOC telemetry showed exploitation attempts persisted well beyond initial disclosure, with detections recorded from mid-July through September 2025 rather than a brief spike. One observed pattern used a POST request to /p/u/doAuthentication.do with an unusually long User-Agent header to retrieve memory data, while much of the attack traffic was traced to infrastructure in the United States and France. Citrix and national defenders urged organizations to identify affected NetScaler ADC and Gateway versions and apply the vendor’s fixed releases immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC observed numerous intermittent attacks targeting CVE-2025-5777 from July through September 2025, indicating continued exploitation rather than a brief spike. Most observed attack traffic during this period originated from the United States and France.
MBSD-SOC reported its first detections of exploitation attempts against CVE-2025-5777. The observed activity included POST requests to /p/u/doAuthentication.do using an unusually long User-Agent header to retrieve memory information.
The Citrix NetScaler ADC and NetScaler Gateway vulnerability CVE-2025-5777 was publicly disclosed. The flaw, later referred to in the reporting as "Citrix Bleed 2," can allow unauthenticated attackers to obtain sensitive information and hijack sessions.
CSIRT Italia reported new vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway that could enable arbitrary file reads, sensitive information disclosure, and denial of service. The notice said only systems configured as described in the vendor bulletin are vulnerable and recommended updating to fixed versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcembsd.jp
Open sourcecve.mitre.org
Open sourcesupport.citrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix multiple vulnerabilities, led by **CVE-2025-5777**, a critical out-of-bounds read flaw dubbed **"Citrix Bleed 2"** because of its similarity to the 2023 Citrix Bleed bug. The vulnerability affects NetScaler deployments used as a Gateway or virtual AAA server and can let a remote unauthenticated attacker read memory, steal sensitive data such as credentials and configuration, hijack sessions, bypass MFA, and potentially gain broader control of affected systems. Citrix and third-party reporting also highlighted **CVE-2025-6543**, a denial-of-service flaw reported as actively exploited, and **CVE-2025-5349**, a high-severity improper access control issue in the NetScaler Management Interface that could allow unauthorized access from the same network segment. Security researchers reported signs consistent with real-world exploitation of **CVE-2025-5777** for initial access, including hijacked Citrix web sessions reused across multiple IP addresses, LDAP-based Active Directory reconnaissance, and use of **ADExplorer64.exe** against multiple domain controllers. Citrix urged administrators to upgrade affected versions immediately, including NetScaler ADC and Gateway `14.1` before `14.1-43.56`, `13.1` before `13.1-58.32`, `13.1-FIPS/NDcPP` before `13.1-37.235-FIPS/NDcPP`, and `12.1-FIPS` before `12.1-55.328-FIPS`, while noting older `12.1` and `13.0` branches are end-of-life. The company also recommended terminating active ICA and PCoIP sessions after patching HA pairs or clusters and monitoring for anomalous HTTP activity associated with session theft.
Jul 24, 2026
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 3, 2026
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026