On July 9, the Cybersecurity and Infrastructure Security Agency (CISA) corroborated GreyNoise findings and added CVE-2025-5777 to the Known Exploited Vulnerabilities (KEV) catalog. By integrating threat intelligence sources directly into security infrastructure, organizations can reduce exposure windows and false positives, maintaining robust protection against CitrixBleed 2 exploitation. By analyzing packet captures, analysts reconstructed the overread offsets and identified consistent leakage patterns, confirming the exploitation of the CVE-2025-5777 flaw. This precision targeting suggests a reconnaissance phase where the attackers fingerprinted appliance versions before launching memory overread attempts, consistent with tactics seen in previous state-affiliated operations. Researchers detected an active exploitation of CVE-2025-5777, dubbed CitrixBleed 2, nearly two weeks before a public proof-of-concept surfaced. GreyNoise analysts assigned a dedicated tag to the traffic on July 7, enabling retrospective visibility into pre-PoC attacks across their sensor network.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 17 Jul 2025 10:10:15 +0000