The first warning of CitrixBleed 2 being exploited came from ReliaQuest on June 27. On July 7, security researchers at watchTowr and Horizon3 published proof-of-concept exploits (PoCs) for CVE-2025-5777, demonstrating how the flaw can be leveraged in attacks that steal user session tokens. The U.S. Cybersecurity & Infrastructure Security Agency has confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway and is giving federal agencies one day to apply fixes. Although CISA confirms exploitation, it is important to note that Citrix has still to update its original security bulletin from June 27, which states that there is no evidence of CVE-2025-5777 exploited in the wild. Such a short deadline for installing the patches is unprecedented since CISA released the Known Exploited Vulnerabilities (KEV) catalog, showing the severity of the attacks exploiting the security issue. With CISA confirming CitrixBleed 2 being actively used in attacks, it is likely that threat actors have now developed their own exploits based on the technical info released last week. Beaumont called the flaw 'CitrixBleed 2' due to similarities with the infamous CitrixBleed vulnerability (CVE-2023-4966), which was extensively exploited in the wild by all types of cybercriminal actors. For the past two weeks, though, threat actors have been active on hacker forums discussing, working, testing, and publicly sharing feedback on PoCs for the Citrix Bleed 2 vulnerability. The agency added the flaw to its Known Exploited Vulnerabilities (KEV) catalog yesterday, ordering federal agencies to implement mitigations by the end of today, June 11. A week later, security researcher Kevin Beaumont warned in a blog post about the flaw's potential for exploitation, its severity and repercussions if left unpatched. At the time, signs of definitive active exploitation in the wild remained elusive, but with the availability of PoCs and ease of exploitation, it was only a matter of time until attackers started to leverage it at a larger scale. BleepingComputer contacted Citrix to ask if there are any updates on the exploitation status of CitrixBleed 2, and we will update this post once a statement becomes available.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 11 Jul 2025 14:50:13 +0000