Definition

CitrixBleed 2 (CVE-2025-5777) is a critical pre-authentication memory-overread in citrix NetScaler ADC/Gateway that leaks session tokens from HTTP responses, enabling MFA bypass via session hijacking—named for parallels to CVE-2023-4966 (original CitrixBleed).

Key Points

  • CVSS 9.3; affects Gateway, ICA Proxy, CVPN, RDP Proxy, AAA virtual server configs
  • Malformed POST to /p/u/doAuthentication.do with empty login leaks ~127 bytes adjacent heap memory
  • CISA KEV listed; federal patch deadline mandated
  • Active IAB exploitation H1 2026 → dragonforce ransomware in <1 hour in advanced cases (huntress)

Patching alone insufficient—terminate all active ICA/PCoIP sessions to invalidate stolen tokens.

Sources