CitrixBleed 2 (2025): the same kind of memory leak two years later, and what changed in the response

In October 2023 Citrix Bleed (CVE-2023-4966) taught everyone who runs a VPN or remote-access gateway one lesson: a memory leak that hands out session tokens isn't fixed by the patch, because the tokens already copied stay valid until someone ends the sessions. LockBit affiliates and others used those tokens for months.

Twenty months later the same products leaked again. CVE-2025-5777, quickly named CitrixBleed 2, is a different bug in a different page of NetScaler ADC and NetScaler Gateway, but the result was the same: an unauthenticated request returns bytes of the device's memory, and session tokens are among them. That makes 2025 a fair test of what the industry learned. Some things improved. Several didn't.

The bug: one form field with no value

The gateway's login form posts to /p/u/doAuthentication.do. watchTowr compared patched and unpatched builds and published the cause on 4 July 2025:

• If the request body contains the field name login with no = and no value, the code notes that a username was sent but never fills the buffer meant to hold it.
• The reply is an XML document that echoes the username back in an <InitialValue> element, printed from that buffer until the first zero byte.
• So the reply carries whatever the stack held before: leftovers of other requests the device handled.
• Each request leaks a small, varying amount. Horizon3 measured about 127 bytes. Attackers simply send it again and again until a session token turns up.

In 2023 the trigger was an oversized Host header on a public OpenID discovery page, and each request returned a large chunk of memory. In 2025 the chunks are small, but the request is just as easy and needs no login. Both are the same class of failure: input that isn't checked, in C code that serves an internet-facing login page.

2023 and 2025, side by side

• Patch: 10 October 2023 · 17 June 2025.
• Exploited before the patch? Yes in 2023, from late August, six weeks as a zero-day · not that we know of for 5777. But its sibling in the same bulletin cycle, CVE-2025-6543, was used as a zero-day from early May 2025, according to the Dutch NCSC.
• First attacks after the patch: about two weeks, once Assetnote published the cause · 3 to 6 days: Kevin Beaumont traced access from 20 June and GreyNoise saw exploit traffic on 23 June, before the first public write-up on 4 July.
• Vendor on exploitation: confirmed within days in 2023 · for weeks Citrix said it had no evidence of attacks. Its blog post was quietly updated on 11 July, the day CISA listed the flaw.
• CISA deadline: three weeks in 2023 · one day for federal agencies in 2025, far shorter than the usual three weeks.
• Session kill in the guidance: added to Citrix's advice about two weeks after the 2023 patch · in the bulletin from day one, which is real progress. But the 2025 list named only ICA and PCoIP connections. Beaumont pointed out that gateway (AAA), RDP and load-balancer persistent sessions also carry leaked cookies, and the 2023 list itself had included kill aaa session -all.
• Old versions: NetScaler 12.1 and 13.0 were already end of life in 2025 and received no fix. Owners on them had to upgrade a major version under time pressure.

What attackers did with the tokens

ReliaQuest published the first signs of in-the-wild use on 26 June 2025, before Citrix acknowledged any:

• A Citrix web session hijacked without the user knowing and without an MFA prompt: the attacker held a token, not a password.
• The same session used from several IP addresses, some expected, some hosted in data centres and consumer VPN ranges.
• LDAP queries for Active Directory reconnaissance, and ADExplorer64.exe run on several machines to map groups, permissions and domain controllers.

Imperva reported more than 11.5 million exploit attempts, about 40% at financial services targets. Beaumont estimated more than 120 organisations compromised in the first weeks, and noted that a NetScaler's own web application firewall did not catch the request.

Why it was hard to see, again

• The vulnerable request is an ordinary-looking POST to the login handler. Beaumont's tell was many POSTs to doAuthentication.do with Content-Length: 5 (the five bytes of login).
• Citrix's own indicators, published 15 July, were log lines such as "Authentication is rejected for" carrying non-ASCII bytes: memory printed where a username should be.
• A replayed token looks like the real user. The best signal is a session whose client IP changes mid-session, which only shows up if the VPN logs keep both addresses and someone compares them.
• Two to three weeks of vendor silence meant many owners treated it as "patch when convenient" while attacks were already under way.

What changed, what didn't

Better: session termination was in the bulletin from the start; CISA moved in a day once exploitation was confirmed; detection firms (GreyNoise, ReliaQuest, Imperva) shared signs publicly within days. Not better: the bug class, the speed gap (patches are now reverse-engineered within days, so the window between fix and attack is closing), a vendor slow to say "exploited", and kill-session advice that again had to be corrected by outsiders.

The gateway owner's runbook

Write this down now, for whichever gateway you run (NetScaler, Ivanti, Fortinet, Palo Alto, SonicWall, or your own app's login). The third leak won't wait for you to plan.

1. Know what's exposed. List every internet-facing login page you own, its product and version. Sign up for the vendor's advisories with an address a person reads, and watch CISA's known-exploited list for those products.
2. Treat "critical, unauthenticated, gateway" as exploited. Don't wait for the vendor to say so. Plan to patch within 24 to 48 hours, and know who can approve a maintenance window at night.
3. Patch every node first, both units of an HA pair or every cluster member, then end sessions. Ending them before the last node is fixed lets a stolen token back in.
4. End every session type, not the one in the bulletin. For NetScaler that means at least AAA, ICA, PCoIP, RDP and load-balancer persistent sessions. Keep the full list in the runbook, tested on a quiet day.
5. Rotate what the gateway saw. Accounts that signed in through it during the exposure window, and service accounts it uses for LDAP.
6. Look back before you look forward. Pull the gateway logs from the patch date backwards: repeated login POSTs, garbage in username fields, sessions whose IP changed. Logs on the box roll over quickly; send them somewhere they're kept for 90 days.
7. Stay off end-of-life versions. A product line with no more fixes turns a one-hour patch into a weekend migration.

If you build a web app, your sign-in is a gateway too. Keep sessions on the server (or a per-user session version) so "sign everyone out" is one statement, and bind sessions to something that changes when they are stolen. The 2023 case and the general pattern: Citrix Bleed 2023: session tokens leaked from the gateway, and why patching didn't log attackers out. Another gateway with chained flaws: Ivanti Connect Secure 2024.

Sources: watchTowr Labs: How much more must we bleed? Citrix NetScaler memory disclosure (CitrixBleed 2, CVE-2025-5777), 4 July 2025; BleepingComputer: Citrix Bleed 2 exploited weeks before PoCs as Citrix denied attacks; BleepingComputer: CISA tags Citrix Bleed 2 as exploited, gives agencies a day to patch; ReliaQuest: Threat Spotlight, Citrix Bleed 2 vulnerability in NetScaler ADC and Gateway devices (26 June 2025); Arctic Wolf: CVE-2025-5777 bulletin and update on session-termination commands; CERT-EU: security advisory 2025-022; CSO Online: exploit details released for Citrix Bleed 2; BleepingComputer: Netherlands says Citrix NetScaler flaw CVE-2025-6543 exploited to breach orgs; The Register: CitrixBleed 2 exploits are on the loose.