ClosedPatched

CitrixBleed 2: NetScaler memory leak exploited to hijack sessions

Citrix NetScaler ADC and Gateway

An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.

Why this severity: Pre-auth memory disclosure, session hijack; CISA KEV; known ransomware use

Started: Jun 17, 2025
Closed: Jul 10, 2025
CVE: CVE-2025-5777

Follow this incident

Updated Jul 10, 2025

Affected

See Citrix bulletin

Fixed in

14.1-43.56
13.1-58.32
13.1-FIPS/NDcPP 13.1-37.235

Timeline5

Jul 10, 2025
CISA adds CVE-2025-5777 to KEV
Jul 4, 2025
watchTowr publishes technical analysis; public PoCs follow
Source
Jun 26, 2025
ReliaQuest reports likely targeted exploitation
Source
Jun 23, 2025
GreyNoise observes exploitation starting
Source
Jun 17, 2025
Citrix discloses CVE-2025-5777 and releases fixes

Advisories2

News & write-ups3

Notes & caveats

Fixed builds as summarized by ReliaQuest/SecurityWeek from the Citrix bulletin; confirm against the Citrix bulletin.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified