Definition
CitrixBleed 2 (CVE-2025-5777) is a critical pre-authentication memory-overread in citrix NetScaler ADC/Gateway that leaks session tokens from HTTP responses, enabling MFA bypass via session hijacking—named for parallels to CVE-2023-4966 (original CitrixBleed).
Key Points
- CVSS 9.3; affects Gateway, ICA Proxy, CVPN, RDP Proxy, AAA virtual server configs
- Malformed POST to
/p/u/doAuthentication.dowith empty login leaks ~127 bytes adjacent heap memory - CISA KEV listed; federal patch deadline mandated
- Active IAB exploitation H1 2026 → dragonforce ransomware in <1 hour in advanced cases (huntress)
Patching alone insufficient—terminate all active ICA/PCoIP sessions to invalidate stolen tokens.