Over 2,100 vulnerable Citrix NetScaler servers remain exposed to active exploitation, despite patches being available for critical vulnerabilities that allow attackers to bypass authentication mechanisms and steal session tokens. ReliaQuest researchers observed concerning indicators suggesting active exploitation, including hijacked Citrix web sessions where authentication was granted without user knowledge, indicating successful MFA bypass. Critically, Citrix advised administrators to execute specific commands after patching: “kill icaconnection -all” and “kill pcoipConnection -all” to terminate active sessions and prevent attackers from maintaining access through previously hijacked sessions. Cybersecurity firm ReliaQuest has issued warnings about active exploitation of two critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway systems. Researchers detected LDAP queries associated with Active Directory reconnaissance and Citrix sessions originating from data-center-hosting IP addresses, including consumer VPN services like DataCamp, suggesting sophisticated obfuscation techniques. CVE-2025-5777, dubbed “Citrix Bleed 2,” carries a CVSS score of 9.2 and represents a dangerous evolution of the original Citrix Bleed vulnerability that wreaked havoc in 2023.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 30 Jun 2025 15:10:16 +0000