Researchers Share CitrixBleed 2 Detection Analysis After Initial Hold
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-5349 | Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway NVD description · AI analysis pending | 8.7 | 5% |
| — | ||
| CVE-2025-5777 | Out-of-Bounds Read (Memory Overread) in Citrix NetScaler ADC and Gateway Citrix NetScaler ADC and NetScaler Gateway contain an out-of-bounds read (CWE-125) caused by insufficient input validation, which can cause the appliance to read beyond the intended memory buffer (a memory overread). The flaw is only triggerable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, so attackers who can reach those services can potentially induce the overread and obtain sensitive memory contents. Such disclosure could aid follow-on compromise, for example by exposing session or authentication data, and CISA notes known ransomware use. Organizations running NetScaler ADC or NetScaler Gateway in the affected Gateway/AAA configurations are exposed. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-07-10 with known ransomware use and an EPSS of 100% (100th percentile), indicating active exploitation, while no public PoC is known and a CVSS score has not yet been assigned. Do: Apply the fixed NetScaler ADC/Gateway builds per Citrix's security advisory (exact affected/fixed version ranges are not in the available data, so consult the bulletin); per CISA KEV, apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Inventory appliances for Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server configurations, since unconfigured/other deployments are not triggerable. After patching, terminate active and idle VPN sessions and hunt for anomalous access, given the known ransomware exploitation and the information-disclosure nature of the flaw. | 9.3 | 100% | KEV ransomware |
| massplausibly hundreds of thousands of installed/internet-exposed NetScaler ADC and Gateway appliances (public scans have historically shown on the order of… |
Full article439 words · extracted from infosecurity-magazine.com · click to collapse
Researchers from WatchTowr have published technical details of a detection script which can be used to identify exploitation of the CitrixBleed 2 vulnerability.
The flaw, tracked as CVE-2025-5777, is a critical out-of-bounds read (CVSS score: 9.3) affecting Citrix NetScaler ADC and Gateway devices version 13.1 before 13.1-58.32 and 14.1 before 14.1-43.56.
When exploited, it allows attackers to bypass authentication mechanisms, including multifactor authentication (MFA), and hijack user sessions.
It was disclosed by Citrix on June 17 alongside CVE-2025-5349, an access control issue.
On June 26, ReliaQuest published a report in which it claimed “with medium confidence” that attackers are actively exploiting CVE-2025-5777 to gain initial access to targeted environments.
WatchTowr, a company known for publishing proof-of-concept (PoC) exploits, initially stated it would refrain from releasing technical details for the CitrixBleed 2 exploit. The main reason for this was that the company observed “a significant portion” of Citrix Netscaler devices that had still not been patched.
However, the WatchTowr later stated that information sharing, such as indicators of compromise (IoCs) and exploitation artifacts, had been minimal, leaving Citrix NetScaler users struggling to assess whether they needed to raise internal alerts.
The company’s researchers released a detailed analysis to help detect CitrixBleed 2 in a report published on July 4.
WatchTowr said it released the analysis to “ensure it’s not just the ‘bad people’ who can identify a vulnerable appliance.”
Speaking to Infosecurity, Andrey Lukashenkov, head of revenue at the vulnerability intelligence firm Vulners, confirmed that, while it “probably can be repurposed to exploit,” the WatchTowr analysis if “not an off the shelf exploit.”
Additionally, WatchTowr said the researchers released “reproducers that don’t act as weaponized PoCs but will allow confident, evidence-based determination of whether a target Citrix Netscaler appliance is vulnerable.”
These include a “no-detection artefact generator,” a tool designed to help defenders test and improve their detection capabilities by generating benign or simulated attack artifacts that mimic real threats but are not inherently malicious.
Here is a breakdown of the attack execution process for exploiting CitrixBleed 2 according to WatchTowr:
- Malicious request submission: The attacker sends a carefully constructed HTTP POST request to the Citrix Gateway login endpoint, altering the login parameter in a way that exploits a memory management flaw
- Server response with sensitive data: The server responds with an XML response that contains a specific tag. If the system is vulnerable, this tag may expose uninitialized memory contents due to improper handling
- Session token extraction and exploitation: By repeatedly sending these requests, the attacker can leak sensitive session tokens stored in memory. If successful, this could allow session hijacking and MFA bypass, granting unauthorized access
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/citrixbleed-2-detection-analysis/