Loading story…
Dutch investigators found malicious webshells on Citrix NetScaler ADC and NetScaler Gateway appliances at multiple organizations following exploitation of critical 2025 NetScaler vulnerabilities. The affected flaws include CVE-2025-5777—an unauthenticated, remotely exploitable out-of-bounds read issue widely known as CitrixBleed 2—along with CVE-2025-5349 and CVE-2025-6543; public proof-of-concept code for CVE-2025-5777 increased the likelihood of broad exploitation.
The Dutch NCSC urged organizations to immediately apply Citrix updates, investigate appliances for signs of compromise, and terminate active ICA, PCoIP, RDP, AAA, and load-balancing persistent sessions after patching. It also released forensic scripts and updated indicators of compromise for reviewing NetScaler coredumps and full appliance images, as researchers warned that exposed and unremediated devices may already have been compromised.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
The NCSC released two forensic scripts to inspect NetScaler coredumps and complete appliance images for compromise. The scripts incorporated indicators of compromise identified through recent NCSC forensic investigations.
Proof-of-concept exploit code for the unauthenticated, remotely exploitable CVE-2025-5777 out-of-bounds read flaw was published, raising the risk of large-scale exploitation.
Citrix remediated CVE-2025-5777 and CVE-2025-5349 in NetScaler ADC and NetScaler Gateway on or before 18 June 2025.
The NCSC determined that one or more advanced threat actors exploited Citrix NetScaler CVE-2025-6543 as a zero-day from at least early May 2025, successfully attacking multiple critical organizations in the Netherlands. Forensic investigations found that the attackers actively erased traces of their activity.
The Dutch Public Prosecution Service (Openbaar Ministerie) disconnected systems from the internet following indications that Citrix NetScaler vulnerabilities had been abused. The reference does not specify when the disconnection occurred.
Citrix released security updates for the critical NetScaler ADC and NetScaler Gateway memory-management vulnerability CVE-2025-6543. The NCSC warned that the flaw had been exploited on unpatched systems and urged organizations to install the updates promptly.
During investigations at multiple Dutch organizations, the NCSC found NetScaler appliances vulnerable to CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543, including malicious webshells that could provide remote access. The NCSC contacted organizations with possible exploitation, while the Digital Trust Center sought to identify and notify additional affected businesses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcencsc.nl
Open sourcedoublepulsar.com
Open sourcencsc.nl
Open sourcecve.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix patched three critical vulnerabilities in on-premises **NetScaler ADC** and **NetScaler Gateway** appliances: `CVE-2025-7775`, `CVE-2025-7776`, and `CVE-2025-8424`. Citrix reported active exploitation of `CVE-2025-7775`, which can cause denial of service or enable arbitrary code execution; the other flaws can also enable code execution and may allow unauthorized access. The Dutch NCSC assessed the risk as **High/High**, citing widespread vulnerable deployments and the likelihood of large-scale exploitation. Citrix cloud services have been updated, while organizations operating affected on-premises appliances should urgently install Citrix fixes, apply vendor mitigations, monitor for suspicious activity, and use the NCSC's updated detection script to investigate potential compromise.
Aug 31, 2026
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026