GreyNoise telemetry shows scanning began on 1 July, nine days before Citrix published full technical guidance, and Censys counts roughly 70,000 NetScaler instances reachable on the public Internet, a stark reminder of the attack surface at stake. Against this backdrop, Splunk’s Threat Research Team has published an analytic story and accompanying Technical Add-on that parse NetScaler audit logs, enrich them with CIM fields, and surface exploitation attempts in real time. When hits appear, responders must first upgrade the appliance, then purge every live VPN and ICA session with kill vpn -all and kill icaconnection -all before rotating credentials and combing logs for lateral-movement artifacts. CitrixBleed 2 (CVE-2025-5777) erupted in 2025 when researchers uncovered an out-of-bounds read in Citrix NetScaler ADC and Gateway that lets an unauthenticated request siphon memory straight from the appliance. Federal agencies had to patch to 14.1-43.56 or 13.1-58.32 by late July, yet even rapid responders face forensics challenges because leaked memory can reveal administrator tokens for the entire appliance. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The flaw is triggered by a malformed POST sent to /p/u/doAuthentication.do, leaking session cookies, MFA tokens, and even plaintext passwords to anyone who asks—no exploit chain required. Splunk analysts noted a sharp uptick in suspicious 200-byte responses containing binary junk and XML tags that match the leak pattern, often followed within minutes by successful VPN logins from unexpected geolocations. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. This attack flow maps the single-packet trigger to the session hijack sequence, underscoring how little attacker effort is needed once the parser mis-handles the login parameter. Splunk’s detection hinges on spotting that malformed POST as well as any NetScaler response containing non-printable bytes sandwiched between XML tags. By 10 July, CISA elevated the bug to its Known Exploited Vulnerabilities catalog, confirming that opportunistic ransomware crews and state actors had already weaponized it in the wild. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 24 Jul 2025 13:10:12 +0000