https://pwn.watch/t/citrixbleed Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 10 Jul 2025 00:00:00 GMT https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777 https://pwn.watch/i/citrixbleed-2-netscaler-cve-2025-5777 Thu, 10 Jul 2025 00:00:00 GMT critical <p>An out-of-bounds read in NetScaler ADC and Gateway leaked memory, including session tokens, to unauthenticated attackers. GreyNoise saw exploitation from June 23, before public PoCs on July 4. After patching, admins had to kill all active ICA, PCoIP, RDP, AAA and LB sessions.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 14.1-43.56, 13.1-58.32, 13.1-FIPS/NDcPP 13.1-37.235</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-10: CISA adds CVE-2025-5777 to KEV</li><li>2025-07-04: watchTowr publishes technical analysis; public PoCs follow (<a href="https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/">source</a>)</li><li>2025-06-26: ReliaQuest reports likely targeted exploitation (<a href="https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2025-5777</p>