Security researcher Kevin Beaumont has previously stated that repeated POST requests to /doAuthentication.do in NetScaler logs is a good indication that someone is attempting to exploit the flaw, especially when the request includes a Content-Length: 5 header. Despite these early signs and repeated warnings from security researcher Kevin Beaumont, Citrix had still not acknowledged active exploitation in its security advisory for CVE-2025-5777. A critical Citrix NetScaler vulnerability, tracked as CVE-2025-5777 and dubbed "CitrixBleed 2," was actively exploited nearly two weeks before proof-of-concept (PoC) exploits were made public, despite Citrix stating that there was no evidence of attacks. "GreyNoise has observed active exploitation attempts against CVE-2025-5777 (CitrixBleed 2), a memory overread vulnerability in Citrix NetScaler. Citrix Bleed 2 is a critical 9.3 severity vulnerability caused by insufficient input validation, which allows attackers to send malformed POST requests to NetScaler appliances during login attempts. GreyNoise confirmed to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on July 9 that the flaw was actively exploited, causing the cyber agency to add it to its Known Exploited Vulnerabilities (KEV) catalog and giving federal agencies one day to patch the flaw. Citrix finally released another blog post on July 15 on how to evaluate NetScaler logs for indicators of compromise. Exploitation began on June 23 — nearly two weeks before a public proof-of-concept (PoC) was released on July 4," explains GreyNoise. In a recent post, Beaumont states that he has been tracking the exploitation since June, with over 120 companies already compromised by the flaw. Citrix has also not responded to BleepingComputer's questions about why the original CVE-2025-5777 advisory still does not acknowledge exploitation. The researcher also warns that Citrix's own Web Application Firewall currently does not detect exploitation of CVE-2025-5777. GreyNoise has confirmed its honeypots detected targeted exploitation from IP addresses located in China on June 23, 2025.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 17 Jul 2025 23:40:12 +0000