A severe security flaw in Citrix NetScaler systems, designated CVE-2025-5777 and known as “CitrixBleed 2,” was actively exploited by attackers nearly two weeks before security researchers released proof-of-concept code, contradicting Citrix’s initial claims of no active exploitation.
## Early Exploitation Detected
GreyNoise, a cybersecurity threat intelligence company, confirmed that their monitoring systems detected targeted attacks against the vulnerability beginning June 23, 2025. The attacks originated from IP addresses in China, occurring 11 days before public exploit code became available on July 4.
“We created a tag on July 7 to track this activity. Because GreyNoise retroactively associates pre-tag traffic with new tags, prior exploitation attempts are now visible,” GreyNoise explained.
Following confirmation of active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-5777 to its Known Exploited Vulnerabilities catalog on July 9, mandating federal agencies patch the flaw within 24 hours.
## Citrix’s Delayed Response
Despite mounting evidence and warnings from security researcher Kevin Beaumont, Citrix initially failed to acknowledge active exploitation in their security advisory. The company only quietly updated their June 26 blog post on July 11, after the vulnerability appeared in CISA’s database. A more comprehensive response came July 15 with guidance on evaluating NetScaler logs for compromise indicators.
Security experts have criticized Citrix for lack of transparency and failure to share indicators of compromise that researchers had previously provided to the company.
## Technical Details of the Vulnerability
CitrixBleed 2 carries a critical severity rating of 9.3 and stems from insufficient input validation. Attackers exploit the flaw by sending malformed POST requests to NetScaler appliances during login attempts, specifically omitting the equal sign in the “login=” parameter.
This technique causes the device to leak 127 bytes of memory per request. Through repeated requests, attackers can extract sensitive information including valid session tokens, which can then be used to hijack legitimate user sessions and gain unauthorized access to internal systems.
## Detection and Indicators
Security researcher Kevin Beaumont identified several key indicators of exploitation attempts:
– Repeated POST requests to `/doAuthentication.do` in NetScaler logs
– Requests containing `Content-Length: 5` headers
– Log entries showing user logoffs with unusual characters like “#” in usernames
– Memory contents appearing in incorrect log fields
Additional indicators include:
– “Authentication is rejected for” messages
– “AAA Message” entries
– Non-ASCII byte values (0x80–0xFF) in logs
– Unusual IP address changes within the same session
## Remediation Steps
Citrix recommends terminating all active sessions using these commands:
“`
kill pcoipConnection -all
kill icaconnection -all
kill rdpConnection -all
kill sshConnection -all
kill telnetConnection -all
kill connConnection -all
kill aaa session -all
“`
Administrators should review all sessions before termination to identify suspicious activity, such as unexpected IP address changes or unauthorized users.
## Scale of Impact
Beaumont reports tracking exploitation since June 20, with over 120 companies already compromised. The attacks appear coordinated, with threat actors carefully profiling NetScaler systems before attacking to ensure they target legitimate installations rather than security honeypots.
Imperva has detected over 11.5 million exploitation attempts, with 40% targeting financial sector organizations. Notably, Citrix’s own Web Application Firewall currently cannot detect CVE-2025-5777 exploitation attempts.
## Immediate Action Required
Citrix has released patches for NetScaler ADC and Gateway versions and strongly urges immediate upgrades. No workarounds or mitigations exist beyond patching. Organizations running end-of-life versions (12.1 and 13.0) must upgrade to supported builds immediately.
The incident highlights the critical importance of rapid patch deployment and the potential for sophisticated threat actors to exploit vulnerabilities before public disclosure, emphasizing the need for proactive security monitoring and swift response protocols.