CISA agrees that CitrixBleed 2 is under exploit

Updated The US Cybersecurity and Infrastructure Security Agency has added its weighty name to the list of parties agreeing that CVE-2025-5777, dubbed CitrixBleed 2 by one researcher, has been under exploitation and abused to hijack user sessions. On Thursday, CISA added the critical security flaw to its catalog of Known Exploited Vulnerabilities. The agency cited "evidence of active exploitation" in its alert. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned. The bug, a 9.3 CVSS-rated security flaw that allows remote, unauthenticated attackers to read sensitive info — such as session tokens — in memory from NetScaler devices configured as a gateway (such as a VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, looked bad from the start. Citrix disclosed and issued a fix for CVE-2025-5777 back on June 17. Shortly thereafter, bug hunters started sounding the alarm on how bad things could get if customers didn't patch immediately. Security maven Kevin Beaumont dubbed the new vulnerability "CitrixBleed 2" because it closely resembled an earlier critical hole in the same NetScale products, CVE-2023-4966, that allowed attackers to access a device's memory, find session tokens, and then use those to impersonate an authenticated user while bypassing multi-factor authentication. By early July, researchers had published at least two working exploits that showed ho...