A severe security flaw in Citrix NetScaler ADC and Gateway systems, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now being actively exploited by cybercriminals, according to cybersecurity firm ReliaQuest.
## What is Citrix Bleed 2?
Named by security researcher Kevin Beaumont for its similarity to the original Citrix Bleed vulnerability, this new flaw is an out-of-bounds memory read vulnerability. It allows unauthorized attackers to access restricted memory areas without authentication, potentially exposing:
– User session tokens
– Login credentials
– Other sensitive data stored on public-facing gateways and virtual servers
This access enables attackers to hijack user sessions and bypass multi-factor authentication (MFA) protections.
## Evidence of Active Exploitation
While Citrix patched the vulnerability on June 17, 2025, with no initial reports of exploitation, ReliaQuest now reports “medium confidence” that attackers are actively using this flaw. Their assessment is based on several concerning observations:
**Attack Indicators:**
– Hijacked Citrix sessions showing authentication without user interaction
– Session reuse across legitimate and suspicious IP addresses
– Post-breach LDAP queries for Active Directory reconnaissance
– Multiple instances of ADExplorer64.exe running across systems
– Connections originating from data center IPs linked to consumer VPN providers
These patterns strongly suggest coordinated attacks following unauthorized Citrix access through the vulnerability.
## Immediate Protection Steps
**1. Update Systems**
Upgrade to these patched versions immediately:
– 14.1-43.56+
– 13.1-58.32+
– 13.1-FIPS/NDcPP 13.1-37.235+
**2. Terminate Active Sessions**
After updating, administrators must end all active ICA and PCoIP sessions, as they may already be compromised.
Before termination, review sessions for suspicious activity using:
– `show icaconnection` command
– NetScaler Gateway > PCoIP > Connections
Then terminate all sessions with:
– `kill icaconnection -all`
– `kill pcoipconnection -all`
**3. Temporary Mitigation**
If immediate patching isn’t possible, restrict external NetScaler access using network ACLs or firewall rules.
## The Bigger Picture
This vulnerability highlights the ongoing threat to enterprise gateway systems. The ability to bypass MFA through session hijacking makes this particularly dangerous for organizations relying on Citrix infrastructure for remote access.
Citrix has not responded to requests for comment regarding the exploitation status of CVE-2025-5777, but the evidence suggests immediate action is critical for affected organizations.