CitrixBleed 2 Flaw Exposes NetScaler ADC and Gateway Sessions
Citrix disclosed CVE-2025-5777 in NetScaler ADC and NetScaler Gateway alongside CVE-2025-5349, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified CVE-2025-5777 as CitrixBleed 2, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access.
After the advisory, proof-of-concept and scanning tools for CVE-2025-5777 appeared on GitHub, including repositories explicitly branded as CitrixBleed 2 scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
Additional GitHub repository for CVE-2025-5777 appears
Another GitHub repository dedicated to CVE-2025-5777 was published, indicating continued public sharing of technical material related to the vulnerability. This suggests ongoing community analysis and tooling development around the issue.
PoC scanner for CVE-2025-5777 is released on GitHub
A GitHub repository named 'citrix_bleed_2' was published with a proof-of-concept scanner for CVE-2025-5777. The release of public scanning code lowered the barrier to identifying potentially vulnerable NetScaler systems.
Public reporting highlights 'CitrixBleed 2' exploitation risk
SOCRadar published analysis describing CVE-2025-5777 as 'CitrixBleed 2' and warning that NetScaler Gateway devices were exposed to remote exploitation. This represents a public escalation in awareness around the vulnerability's severity and attack potential.
ENISA EUVD publishes an entry for CVE-2025-5777
ENISA's EU Vulnerability Database added an entry for CVE-2025-5777, reflecting broader public cataloging of the issue after vendor disclosure. The listing indicates the vulnerability had entered formal vulnerability-tracking channels.
Citrix discloses CVE-2025-5777 and CVE-2025-5349 in NetScaler bulletin
Citrix published a security bulletin for NetScaler ADC and NetScaler Gateway covering CVE-2025-5777 and CVE-2025-5349. This marks the public vendor disclosure of the vulnerability and the availability of official remediation guidance.
Sources
4 references tracked. Mallory keeps watching after this page renders.
GitHub - 0xBlackash/CVE-2025-5777: CVE-2025-5777 · GitHub
github.com
Open sourceGitHub - RaR1991/citrix_bleed_2: Citrix Bleed 2 PoC Scanner (CVE-2025-5777) · GitHub
github.com
Open sourceCVE-2025-5777 (CitrixBleed 2) Exposes NetScaler Gateway Devices to Remote Exploitation
socradar.io
Open sourceEUVD-2025-18497 | EUVD
euvd.enisa.europa.eu
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix NetScaler Flaws Enable RCE and Session Token Theft
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
CitrixBleed Flaws Exposed NetScaler Sessions to LockBit-Linked Intrusions
Researchers detailed how ransomware operators linked to **LockBit** exploited Citrix NetScaler ADC and Gateway appliances through the original **CitrixBleed** flaw, `CVE-2023-4966`, using stolen session data to support follow-on access and affiliate infrastructure operations. An OSINT analysis built from joint government and Boeing-published indicators identified additional suspected LockBit infrastructure spanning command-and-control, remote management, FTP, RDP, and OpenVPN services, with recurring hosting patterns and overlaps with tooling and infrastructure previously associated with **Akira**, **Avaddon**, **Cerber**, **BumbleBee**, **Raccoon Stealer**, **RecordBreaker**, **SolarMarker**, **8Base**, and **ShadowSyndicate**. A later root-cause analysis of **CitrixBleed 2**, `CVE-2025-5777`, showed that a malformed POST request to `/p/u/doAuthentication.do` can trigger an out-of-bounds memory disclosure on vulnerable NetScaler devices, leaking up to `0x7F` bytes per request in an authentication failure response. Researchers warned that exposed memory may include credentials, session cookies, and private keys, making the bug a low-noise path to unauthenticated access similar in impact to the earlier CitrixBleed incidents; Citrix issued fixes and defenders were urged to patch immediately, invalidate sessions, reset credentials, rotate certificates and secrets where needed, and review telemetry for LockBit-related indicators, while broad community IOC feeds for suspected **LockBit 5.0** activity have also circulated with explicit false-positive caveats.
Jun 29, 2026
Critical Vulnerabilities Disclosed in Citrix NetScaler ADC and Gateway
Citrix disclosed critical vulnerabilities affecting **NetScaler ADC** and **NetScaler Gateway**, prompting alerts from both the Canadian Centre for Cyber Security and CERT-EU. The issues are tracked as `CVE-2026-3055` and `CVE-2026-4368`, and impact multiple supported release branches, including **14.1**, **13.1**, and **13.1 FIPS/NDcPP** versions running below the vendor’s fixed builds. Affected deployments include standard **NetScaler ADC**, **NetScaler Gateway**, and hardened **FIPS/NDcPP** editions. Government cyber authorities urged organizations to review Citrix’s security bulletin and apply the recommended updates and mitigations without delay. The coordinated advisories indicate broad concern across enterprise and public-sector environments that rely on Citrix application delivery and remote access infrastructure, with administrators advised to identify exposed appliances and move vulnerable systems to patched versions listed by Citrix.
Jul 1, 2026