{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "citrixbleed",
    "label": "CitrixBleed",
    "isStack": false,
    "url": "https://pwn.watch/t/citrixbleed",
    "feed": "https://pwn.watch/t/citrixbleed/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "citrixbleed-2-netscaler-cve-2025-5777",
      "title": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777",
      "json": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Citrix NetScaler ADC and Gateway",
      "tags": [
        "citrixbleed",
        "citrix",
        "netscaler",
        "zero-day",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2025-5777"
      ],
      "affectedVersions": [
        "See Citrix bulletin"
      ],
      "fixedVersions": [
        "14.1-43.56",
        "13.1-58.32",
        "13.1-FIPS/NDcPP 13.1-37.235"
      ],
      "startedAt": "2025-06-17",
      "closedAt": "2025-07-10",
      "updatedAt": "2025-07-10",
      "summary": "An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "citrixbleed-2-netscaler-cve-2025-5777",
      "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-10",
      "title": "CISA adds CVE-2025-5777 to KEV",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777"
    },
    {
      "incident": "citrixbleed-2-netscaler-cve-2025-5777",
      "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-04",
      "title": "watchTowr publishes technical analysis; public PoCs follow",
      "body": null,
      "sourceUrl": "https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/",
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777"
    },
    {
      "incident": "citrixbleed-2-netscaler-cve-2025-5777",
      "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-26",
      "title": "ReliaQuest reports likely targeted exploitation",
      "body": null,
      "sourceUrl": "https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/",
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777"
    },
    {
      "incident": "citrixbleed-2-netscaler-cve-2025-5777",
      "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-23",
      "title": "GreyNoise observes exploitation starting",
      "body": null,
      "sourceUrl": "https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc",
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777"
    },
    {
      "incident": "citrixbleed-2-netscaler-cve-2025-5777",
      "incidentTitle": "CitrixBleed 2: NetScaler memory leak exploited to hijack sessions",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-17",
      "title": "Citrix discloses CVE-2025-5777 and releases fixes",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777"
    }
  ]
}