Two critical vulnerabilities, CVE-2025-5777 (CitrixBleed 2) and CVE-2025-6543, affecting Citrix NetScaler ADC and Gateway have been reported to be exploited in the wild. Citrix has released patches and urged users to update vulnerable versions immediately to prevent potential session hijacking and denial of service attacks. #CitrixBleed2 #CVE2025-6543
Keypoints
- CVE-2025-5777, nicknamed CitrixBleed 2, is an out-of-bounds read vulnerability allowing attackers to access sensitive memory and potentially bypass MFA by stealing session tokens.
- CVE-2025-6543 is a separate critical denial of service (DoS) vulnerability caused by memory overflow and was exploited as a zero-day in the wild.
- Both vulnerabilities affect Citrix NetScaler ADC and Gateway versions prior to the patched releases; versions 12.1 and 13.0 are end-of-life and do not receive updates.
- Citrix released security bulletins CTX693420 and CTX694788 on June 17 and June 25 respectively, detailing the vulnerabilities and available patches.
- No public proof-of-concept exploits have been released yet for either vulnerability as of June 27.
- Citrix recommends terminating all active ICA and PCoIP sessions after patching to mitigate risks.
- Indicators of Compromise (IoCs) are available through Citrix customer support, and Tenable has released plugin coverage for these vulnerabilities.
MITRE Techniques
- [T1550] Use of Valid Accounts – Attackers exploited stolen session tokens from CVE-2025-5777 to bypass multi-factor authentication and hijack authenticated sessions (“…allowing the attacker to take over an authenticated session”).
- [T1499] Endpoint Denial of Service – CVE-2025-6543 exploits a memory overflow issue to cause denial of service on Citrix NetScaler ADC and Gateway devices (“…a DoS vulnerability resulting from a memory overflow issue”).
Indicators of Compromise
- [File Hashes] Examples related to exploitation and detection – not publicly detailed; customers must contact Citrix support for updates.
- [Commands] Mitigation commands to close active sessions post-patching – kill icaconnection -all, kill pcoipConnection -all.