A new critical vulnerability in Citrix NetScaler devices has security experts warning of potential widespread exploitation, drawing alarming parallels to the devastating “CitrixBleed” attacks that plagued organizations in 2023. The vulnerability, tracked as CVE-2025-5777 and dubbed “CitrixBleed 2,” allows attackers to steal sensitive information directly from device memory, potentially bypassing multi-factor authentication and hijacking user sessions. By sending a malformed HTTP request to the Citrix Gateway login endpoint without proper parameter values, attackers can trigger a memory leak that exposes uninitialized variables containing sensitive data from the device’s memory. The vulnerability analysis disclosed by watchTower Labs researchers shows that the memory leak vulnerability affects NetScaler ADC and NetScaler Gateway devices configured as remote access gateways. Despite Citrix’s initial claims of no active exploitation, cybersecurity firm ReliaQuest reported that they have observed “medium confidence” indicators suggesting the vulnerability is already being exploited in targeted attacks. Given the severe impact of the original CitrixBleed attacks, which continued to be exploited for months after patches were available, security experts emphasize that organizations cannot afford to delay patching efforts. “The backend parser ends up handing us back an uninitialized local variable” containing whatever data was previously stored in memory, potentially including session tokens and other sensitive information. Critical flaw in Citrix NetScaler devices echoes infamous 2023 security breach that crippled major organizations worldwide. The original CitrixBleed vulnerability (CVE-2023-4966) was extensively exploited by ransomware groups and nation-state actors, leading to high-profile breaches including attacks on Boeing and Comcast’s Xfinity service that affected 36 million customers. Security researcher Kevin Beaumont, who coined the “CitrixBleed 2” moniker, noted that over 50,000 potentially vulnerable NetScaler instances are exposed to the internet based on Shodan searches. With a critical CVSS severity score of 9.3, the vulnerability stems from insufficient input validation that leads to memory overread when processing authentication requests. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 05 Jul 2025 13:40:10 +0000