A critical vulnerability designated CVE-2025-5777, known as CitrixBleed 2, has emerged as a severe security flaw affecting Citrix NetScaler ADC and Gateway devices with a CVSS score of 9.3. The vulnerability stems from insufficient input validation that leads to memory overread conditions, allowing attackers to extract sensitive data directly from device memory.
This flaw bears striking similarities to the original CitrixBleed vulnerability (CVE-2023-4966), though it shifts focus from session cookies to session tokens, creating new attack vectors for malicious actors.
The vulnerability’s most alarming capability lies in its ability to completely bypass multifactor authentication mechanisms. Attackers can steal valid session tokens from memory, granting them access to protected systems even when MFA remains active on targeted accounts. These hijacked tokens often provide persistent access that can survive user session termination, effectively neutralizing the security benefits of multiple authentication factors.
Exploitation requires specific configurations, particularly when appliances operate as Gateway services including VPN virtual servers, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers. Attackers perform out-of-bounds memory reads to access session tokens stored within device memory, allowing detailed session hijacking capabilities. Security researchers have confirmed active exploitation attempts targeting vulnerable devices in production environments.
CitrixBleed 2 represents a significant evolution from its predecessor, CVE-2023-4966, which focused on browser-based session cookies. The current vulnerability targets tokens supporting API and non-browser authentication methods, potentially facilitating broader and more persistent system compromise.
The original CitrixBleed experienced widespread exploitation by ransomware groups and state-sponsored actors, raising concerns about similar targeting for this new variant. With over 69K NetScaler instances exposed online, the exploitation risk continues to escalate across internet-facing deployments.
Affected systems include versions prior to 14.1 47.46 and 13.1 59.19 for both ADC and Gateway appliances. Detection strategies rely on monitoring out-of-bounds read anomalies and identifying suspicious access patterns characteristic of session hijacking activities.
Citrix has issued urgent security bulletins recommending immediate patching and upgrade procedures. Organizations are advised to terminate all active sessions following patch implementation to prevent reuse of compromised tokens, as security analytics frameworks update detection rules to identify exploitation attempts. ReliaQuest identified exploitation attempts by June 26, confirming the vulnerability’s active use in the wild.
