Citrix recently addressed two critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), both of which pose significant risks to enterprise networks if left unpatched.
CVE-2025-5349: Improper Access Control
• Description: This vulnerability affects the NetScaler Management Interface. Attackers with access to the Network Services IP (NSIP), Cluster Management IP, or local Global Server Load Balancing (GSLB) Site IP can exploit this flaw to gain unauthorized access to critical management functions.
• Risk: Unauthorized access to management functions, potentially allowing attackers to manipulate system configurations or access sensitive data.
CVE-2025-5777: Insufficient Input Validation (Memory Overread) aka Citrix Bleed 2
• Description: This critical vulnerability is due to insufficient input validation, resulting in a memory overread. It specifically impacts systems configured as Gateway services (VPN virtual servers, ICA Proxy, Citrix Virtual Private Network, RDP Proxy, or Authentication, Authorization, and Accounting (AAA) virtual servers).
• Risk: Successful exploitation could allow attackers to read sensitive memory contents, including credentials and configuration data, posing a risk of data leakage and compromise of corporate resources.
Affected Versions
The following versions are vulnerable and require immediate updates:
• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-43.56
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-58.32
• NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.235-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS before 12.1-55.328-FIPS
Note: Versions 12.1 and 13.0 are end-of-life (EOL) and will not receive security updates. Organizations using these versions should upgrade to a supported release immediately.
Mitigation Steps
• Upgrade: Apply the latest patches—upgrade to NetScaler ADC and Gateway 14.1-43.56 or later, 13.1-58.32 or later, or the corresponding FIPS-compliant releases.
• Post-Update Actions: After upgrading, administrators should terminate all active ICA and PCoIP sessions to ensure complete protection. This can be done using the following commands:
kill icaconnection -all
kill pcoipConnection -all• Cloud Deployments: Customers using Citrix-managed cloud services are automatically updated.
Impact and Urgency
Both vulnerabilities can be exploited remotely, and exploitation could lead to unauthorized access, data leakage, and compromise of sensitive corporate data and network resources. Immediate patching is strongly advised for all affected systems
Update: 6/27/2025
The advisory initially stated that the vulnerability affected the NetScaler management interface, but references to the management interface were removed shortly after, and Citrix clarified that NetScaler instances are vulnerable when configured as a gateway for remote access or an AAA virtual server. As security researcher Kevin Beaumont explained in a blog post, this seemingly minor change made the vulnerability more serious because the management interface should typically not be exposed to the internet, but NetScaler is often configured for remote access in major organizations.
Beaumont warned that over 50,000 potentially vulnerable instances are exposed to the internet (based on a Shodan search). CVE-2025–5777 can allow a remote, unauthenticated attacker to read memory from affected NetScaler instances, including sensitive information like session tokens, which can be used to hijack sessions and bypass multi-factor authentication (MFA). The vulnerability is similar to the NetScaler vulnerability tracked as CVE-2023-4966 and known as CitrixBleed, which was widely exploited in 2023 by ransomware groups and other threat actors. Citrix told customers when it released its advisory that it was unaware of any in-the-wild exploitation, but Beaumont and others warned that attacks involving CVE-2025–5777 were highly probable. ReliaQuest stated on Thursday that it has seen some evidence suggesting that CitrixBleed 2 has been exploited in the wild.
As security researcher Kevin Beaumont explained in a blog post, this apparently minor change made the vulnerability more serious as the management interface should typically not be exposed to the internet, but NetScaler is often configured for remote access in major organizations.
Beaumont warned that over 50,000 potentially vulnerable instances are exposed to the internet (based on a Shodan search).
CVE-2025–5777 can allow a remote, unauthenticated attacker to read memory from affected NetScaler instances, including sensitive information such as session tokens, which can be leveraged to hijack sessions and bypass multi-factor authentication (MFA).
The vulnerability is reminiscent of the NetScaler vulnerability tracked as CVE-2023-4966 and referred to as CitrixBleed, which was widely exploited in 2023 by ransomware groups and other threat actors.
Citrix told customers when it published its advisory that it had not been aware of in-the-wild exploitation, but Beaumont and others warned that attacks involving CVE-2025–5777 were highly likely.
ReliaQuest said on Thursday that it has seen some evidence suggesting that CitrixBleed 2 has been exploited in the wild.
“ReliaQuest assesses with medium confidence that attackers are actively exploiting this vulnerability to gain initial access to targeted environments,” the company said.
ReliaQuest has identified several concerning pieces of evidence, including hijacked Citrix sessions from NetScaler devices and unauthorized authentication granted without the user’s knowledge, which may indicate a possible MFA (Multi-Factor Authentication) bypass. Additionally, there is evidence of session reuse across multiple IP addresses, both suspicious and expected. The activities observed are typically associated with Active Directory (AD) reconnaissance, and some sessions are originating from data center IP addresses linked to VPN services.
“Citrix Bleed 2 mirrors the original in its ability to bypass authentication and facilitate session hijacking, but it introduces new risks by targeting session tokens instead of session cookies. Unlike session cookies, which are often tied to short-lived browser sessions, session tokens are typically used in broader authentication frameworks, such as API calls or persistent application sessions,” ReliaQuest explained.
“This means that attackers could potentially maintain access longer and operate across multiple systems without detection, even after the user has terminated the browser session,” it added.
Following the security firm’s report, Beaumont said he could not confirm active exploitation of CitrixBleed 2 and pointed out that Citrix has not shared any indicators of compromise (IoCs). However, the researcher believes — based on the evidence seen by ReliaQuest — that if the vulnerability is indeed being exploited, the attacks are “probably” conducted by a ransomware group.
If confirmed, CVE-2025–5777 would be the second Citrix NetScaler flaw whose exploitation has come to light this week. Citrix on Wednesday urged customers to patch CVE-2025-6543, a security hole that can lead to unintended control flow and DoS attacks, after seeing in-the-wild exploitation.
