Citrix NetScaler Flaws Enable RCE and Session Token Theft
Multiple severe vulnerabilities in Citrix ADC and NetScaler Gateway exposed organizations to unauthenticated compromise, including remote code execution in CVE-2019-19781 and CVE-2023-3519, as well as memory disclosure in CVE-2023-4966 (CitrixBleed) and the later CVE-2025-5777 variant. Public reporting showed that CVE-2019-19781 could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on CVE-2023-3519 examined another critical path to code execution on internet-facing Citrix infrastructure.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
14 events from the most recent confirmed update back to the earliest known activity.
Citrix NetScaler exploitation confirmed in new 2026 reporting
Cybersecurity Dive reported that Citrix NetScaler products were confirmed to be under exploitation. This represents a new public confirmation of active abuse affecting NetScaler systems beyond the previously documented 2025 CitrixBleed 2 reporting.
Akamai publishes mitigation guidance for CitrixBleed 2 (CVE-2025-5777)
Akamai published mitigation guidance for CVE-2025-5777, referred to as CitrixBleed 2, affecting NetScaler memory disclosure. The publication reflects public technical guidance on defending against the flaw.
Active exploitation of CitrixBleed 2 reported as patching lags
Reporting indicated that CVE-2025-5777, dubbed CitrixBleed 2, was already being exploited in the wild while many organizations were slow to patch affected NetScaler systems. The development marked an escalation from vulnerability awareness to observed malicious abuse.
Reports indicate CitrixBleed 2 is under active attack
Computer Weekly reported that CVE-2025-5777, known as CitrixBleed 2, was believed to be under active attack. This marks public reporting that the vulnerability had moved from disclosure concern to suspected in-the-wild exploitation.
Citrix issues security bulletin for CVE-2025-5349 and CVE-2025-5777
Citrix published a NetScaler ADC and NetScaler Gateway security bulletin covering CVE-2025-5349 and CVE-2025-5777. The advisory marked the vendor's official disclosure and guidance for the vulnerabilities affecting NetScaler products.
HHS warns healthcare sector of CitrixBleed attacks after hospital outages
The U.S. Department of Health and Human Services warned the healthcare sector about CitrixBleed attacks after hospital outages were reported. The alert marked a sector-specific government response highlighting operational impact on healthcare organizations.
CISA warns CitrixBleed is targeted by nation-state and criminal hackers
CISA said the CitrixBleed vulnerability, CVE-2023-4966, was being actively exploited by both nation-state and financially motivated threat actors. The warning marked an official U.S. government alert highlighting the breadth and seriousness of ongoing exploitation.
Organizations rush to patch and hunt after CitrixBleed exploitation warnings
Following public reporting on CitrixBleed (CVE-2023-4966), defenders were urged to rapidly patch affected NetScaler systems and investigate for signs of compromise as concern grew over active malicious exploitation. The development marked an operational response phase beyond the initial technical reporting on the flaw.
CitrixBleed (CVE-2023-4966) threat brief is published
Unit 42 published a threat brief on CVE-2023-4966, commonly known as CitrixBleed, documenting the vulnerability and associated threat activity. This marks public reporting on the issue by early November 2023.
Citrix patches CVE-2023-3519 and warns of targeted exploitation
Cloud Software Group disclosed and released fixed builds for CVE-2023-3519, a critical unauthenticated remote code execution flaw affecting customer-managed NetScaler ADC and NetScaler Gateway deployments configured as a gateway or AAA virtual server. The company said no workaround was available beyond upgrading and warned the vulnerability was being exploited in targeted attacks.
Assetnote publishes analysis of CVE-2023-3519 in Citrix ADC and NetScaler Gateway
Assetnote published research analyzing CVE-2023-3519 in Citrix ADC and NetScaler Gateway, adding technical detail to understanding of the vulnerability. The reference indicates public disclosure of analysis by July 2023.
Citrix releases patches for CVE-2019-19781
Citrix released patches for CVE-2019-19781 in late January 2020 after initially providing only mitigation guidance. The fixes addressed the widely exploited remote code execution risk on vulnerable appliances.
Public exploits and active abuse emerge for CVE-2019-19781
By early 2020, public exploit code for CVE-2019-19781 became available and FireEye reported threat actors were actively exploiting vulnerable Citrix systems to install malware, including NOTROBIN. The exploitation chain involved directory traversal and template parsing to achieve unauthenticated remote code execution.
Citrix discloses CVE-2019-19781 and recommends mitigations
Citrix disclosed the authentication bypass vulnerability CVE-2019-19781 affecting Citrix ADC, Gateway, NetScaler, and SD-WAN WANOP products. The company initially advised customers to apply mitigations before patches were available.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
17 references tracked. Mallory keeps watching after this page renders.
Citrix NetScaler products confirmed to be under exploitation | Cybersecurity Dive
cybersecuritydive.com
Open sourceTrustedSec | NetScaler Remote Code Execution Forensics
trustedsec.com
Open sourceMitigating CitrixBleed 2 (CVE‑2025‑5777) NetScaler Memory Disclosure with App & API Protector | Akamai
akamai.com
Open sourceCitrixBleed 2 exploits on the loose as orgs slow to patch
theregister.com
Open sourceCVE-2019-19781: Citrix ADC RCE vulnerability - Hacking Tutorials
hackingtutorials.org
Open sourceRough Patch: I Promise It'll Be 200 OK (Citrix ADC CVE-2019-19781) | FireEye Inc
fireeye.com
Open sourceCitrix ADC Exploits are Public and Heavily Used. Attempts to Install Backdoor
isc.sans.edu
Open sourceCVE-2019-19781: Unauthenticated Remote Code Execution Vulnerability in Citrix ADCs and Gateways - Blog | Tenable®
fr.tenable.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical Citrix NetScaler Flaws Expose ADC and Gateway Appliances
Citrix NetScaler ADC and NetScaler Gateway appliances are affected by multiple critical vulnerabilities that can expose organizations to compromise, including `CVE-2025-5349`, `CVE-2025-5777`, and `CVE-2026-3055`. The flaws impact supported NetScaler releases, while end-of-life versions `12.1` and `13.0` remain vulnerable without fixes. `CVE-2025-5349` enables access-control bypass on the management interface, `CVE-2025-5777` is an out-of-bounds read that can leak sensitive memory contents, and `CVE-2026-3055` is an input-validation flaw that can lead to memory overwrite when NetScaler is configured as a SAML Identity Provider.
Jun 29, 2026
CitrixBleed 2 Flaw Exposes NetScaler ADC and Gateway Sessions
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 1, 2026
Citrix NetScaler Flaws Expose ADC and Gateway to Remote DoS and Memory Errors
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026