CitrixBleed‑2 (CVE‑2025‑5777)

[oceanstack]

What’s happening: CISA warns that a critical out‑of‑bounds read flaw in Citrix NetScaler ADC and Gateway—dubbed CitrixBleed‑2 (CVE‑2025‑5777)—is actively exploited in the wild

Why it matters: Attackers can extract session tokens and credentials without any authentication, compromising VPN tunnels and remote access for countless organizations

Who’s affected: Primarily Citrix NetScaler ADC/Gateway setups across enterprises and service providers. Not just theoretical: scan activity is spiking

What to do now:

Apply Citrix’s July patch (CTX693420) immediately.

Enforce multi-factor authentication (MFA) on all VPNs.

Monitor logs—especially for POST requests at /doAuthentication—for signs of exploitation

Bottom line: CitrixBleed‑2 is a high-severity, currently exploited zero-day. Immediate patching and vigilant VPN security checks are mandatory.