Loading story…
Three vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway—CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543—have prompted urgent patching and compromise checks. CVE-2025-5777, nicknamed CitrixBleed 2, is a memory-overread flaw that could expose session tokens and plaintext credentials. Horizon3.ai demonstrated an attack believed to exploit it through the /p/u/doAuthentication.do endpoint, leaking up to 127 bytes of adjacent memory. GreyNoise has observed malicious attempts targeting the flaw, but its reference does not establish successful exploitation. Citrix said it had not observed exploitation of CVE-2025-5777 at the time of the research, a position disputed by some security firms. Separately, Citrix acknowledged active exploitation of CVE-2025-6543, a memory-corruption vulnerability with potential control-flow or denial-of-service impact, which CISA added to its Known Exploited Vulnerabilities catalog.
The Dutch National Cyber Security Centre urged affected organizations to install Citrix updates promptly, investigate indicators of compromise, and terminate connections and sessions after patching so stolen sessions cannot preserve attacker access. The Netherlands Public Prosecution Service disconnected its systems from the internet after indications of abuse. Defenders should review logs for non-printable characters, investigate sessions used from multiple client IP addresses, and check for unauthorized accounts or configuration changes. Multiple NetScaler versions, including FIPS/NDcPP builds, are affected; organizations should verify their appliances against the relevant advisories. The NCSC warned that NetScaler and other internet-facing edge devices are attractive targets because their compromise can provide further access to organizational networks.
See which actors are running it and whether you're in range.
10 events from the most recent confirmed update back to the earliest known activity.
GreyNoise created an activity tag classifying observed attempts to exploit CVE-2025-5777 as malicious. The reference does not identify victims or establish successful exploitation.
Citrix published an advisory for CVE-2025-6543 affecting NetScaler ADC and NetScaler Gateway. The memory corruption vulnerability could cause control-flow issues or denial of service.
Citrix published an advisory covering vulnerabilities in NetScaler ADC and NetScaler Gateway, including affected FIPS and NDcPP builds. CVE-2025-5777 is a memory overread vulnerability subsequently nicknamed CitrixBleed 2.
The Dutch NCSC urged affected organizations to install Citrix updates promptly and inspect systems for indicators of compromise. It explicitly recommended terminating connections and sessions after patching to prevent attackers from retaining access through stolen sessions.
The Netherlands Public Prosecution Service disconnected its systems from the internet in response to indications of abuse reported in the context of the NetScaler vulnerabilities.
Horizon3.ai described patch-diff analysis and a working exploit believed to target CVE-2025-5777 through the /p/u/doAuthentication.do endpoint. Testing demonstrated leakage of up to 127 bytes of adjacent memory, including session tokens and plaintext credentials.
Citrix Cloud Security Group stated that CVE-2025-5777 and the original CitrixBleed vulnerability, CVE-2023-4966, were unrelated. Citrix also said it had not observed CVE-2025-5777 exploitation in the wild, a position disputed by some security firms.
CISA added CVE-2025-6543 to its Known Exploited Vulnerabilities catalog, recognizing exploitation of the NetScaler vulnerability.
Citrix stated that it was aware of in-the-wild exploitation of the NetScaler memory corruption vulnerability CVE-2025-6543.
Citrix released security updates addressing CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543 in affected NetScaler products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcehorizon3.ai
Open sourceviz.greynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix multiple vulnerabilities, led by **CVE-2025-5777**, a critical out-of-bounds read flaw dubbed **"Citrix Bleed 2"** because of its similarity to the 2023 Citrix Bleed bug. The vulnerability affects NetScaler deployments used as a Gateway or virtual AAA server and can let a remote unauthenticated attacker read memory, steal sensitive data such as credentials and configuration, hijack sessions, bypass MFA, and potentially gain broader control of affected systems. Citrix and third-party reporting also highlighted **CVE-2025-6543**, a denial-of-service flaw reported as actively exploited, and **CVE-2025-5349**, a high-severity improper access control issue in the NetScaler Management Interface that could allow unauthorized access from the same network segment. Security researchers reported signs consistent with real-world exploitation of **CVE-2025-5777** for initial access, including hijacked Citrix web sessions reused across multiple IP addresses, LDAP-based Active Directory reconnaissance, and use of **ADExplorer64.exe** against multiple domain controllers. Citrix urged administrators to upgrade affected versions immediately, including NetScaler ADC and Gateway `14.1` before `14.1-43.56`, `13.1` before `13.1-58.32`, `13.1-FIPS/NDcPP` before `13.1-37.235-FIPS/NDcPP`, and `12.1-FIPS` before `12.1-55.328-FIPS`, while noting older `12.1` and `13.0` branches are end-of-life. The company also recommended terminating active ICA and PCoIP sessions after patching HA pairs or clusters and monitoring for anomalous HTTP activity associated with session theft.
Sep 3, 2026
Dutch investigators found malicious webshells on Citrix NetScaler ADC and NetScaler Gateway appliances at multiple organizations following exploitation of critical 2025 NetScaler vulnerabilities. The affected flaws include `CVE-2025-5777`—an unauthenticated, remotely exploitable out-of-bounds read issue widely known as CitrixBleed 2—along with `CVE-2025-5349` and `CVE-2025-6543`; public proof-of-concept code for `CVE-2025-5777` increased the likelihood of broad exploitation. The Dutch NCSC urged organizations to immediately apply Citrix updates, investigate appliances for signs of compromise, and terminate active ICA, PCoIP, RDP, AAA, and load-balancing persistent sessions after patching. It also released forensic scripts and updated indicators of compromise for reviewing NetScaler coredumps and full appliance images, as researchers warned that exposed and unremediated devices may already have been compromised.
Aug 31, 2026