Attackers Now ‘Scanning Extensively’ for Citrix Bleed 2

Attackers have ramped up their collective attempts to find exploitable Citrix NetScaler devices that remain unpatched to fix a flaw first publicly detailed last month.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

The scanning activity appears to be heavily focused on finding a pre-authentication remote memory disclosure vulnerability in Citrix NetScaler ADC and Gateway appliances, tracked as CVE-2025-5777 and assigned a CVSS score of 9.3, which makes it “critical” (see: Attackers Actively Exploit ‘Citrix Bleed 2’ Vulnerability).

Cloud Security Group released a patch to fix CVE-2025-5777 on June 17.

“Since the disclosure of CVE-2025-5777, we have observed increasing attack activity targeting potentially vulnerable Citrix NetScaler instances worldwide,” said cybersecurity firm Imperva, which developed a web application firewall that it said has been updated to block such efforts. “Attackers appear to be scanning extensively for exposed appliances and attempting to exploit the memory leak vulnerability to harvest sensitive data.”

Attackers can do this “by sending specially crafted HxTxTxPx requests to a vulnerable Citrix endpoint,” said Gabriella Sharadin and Avidan Reich of Imperva’s threat research team, in a blog post.

As of Friday, the firm reported seeing “more than 11.5 million attack attempts, targeting thousands of sites,” with 40% of those efforts targeting the financial services sector. “Many of these attacks are opportunistic, leveraging automated tools to indiscriminately scan large sections of the internet,” with 60% of such efforts targeting the U.S.-based organizations, followed by 11% hitting Spain and 6% Japan, it said.

CISA Confirms Active Exploits

On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-5777 to it’s catalog of known exploited vulnerabilities. The agency also set a deadline of just 24 hours for federal civilian agencies to patch the flaw, or temporarily discontinue using affected products until they could be patched, which is advice that extends to any organization that uses the technology.

Based on his ongoing internet scans, British security research Kevin Beaumont said in a post to social platform Mastodon on Saturday that he found 18,000 internet-connected NetScaler devices, of which 13% remained unpatched, compared to 24% being unpatched as of July 7.

Beaumont nicknamed CVE-2025-5777 “Citrix Bleed 2,” given how the prerequisites for exploiting the flaw and risk it poses parallel the 2023 vulnerability tracked as CVE-2023-4966, aka Citrix Bleed. To be clear, he doesn’t think the flaws are directly connected. Rather, both can be exploited to facilitate unauthorized memory reads and enable attackers to steal session tokens, provided a device is configured to serve as a gateway or AAA virtual server.

When Cloud Security Group released updates to patch CVE-2025-5777 on June 17, it told customers: “We strongly urge that users operating affected NetScaler ADC builds configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server immediately install the recommended builds.” The company added that “there are no available mitigations” and also that “it is not possible to fix the vulnerabilities with web application firewall signatures.”

After patching, CSG said administrators must terminate all active ICA and PCoIP sessions to block attackers’ ability to log in again using stolen session cookies.

Confusingly, on June 25, CSG released a patch for another flaw, CVE-2025-6543, with a CVSS score of 9.3, that it said also requires immediate patching. The company described the flaw, which could be exploited to cause a denial of service attack, as being a zero-day vulnerability and said it was already being exploited before Citrix issued its security alert and patch.

When Did Exploits Begin?

When attackers began exploiting CVE-2025-5777 remains an open question.

Threat intelligence platform GreyNoise Intelligence last week reported seeing exploit attempts start by at least June 23.

Beaumont said organizations he works with retrospectively found in their logs’ IP addresses tied to known exploitation activity, which first appeared by mid-June.

“One of the IP addresses executing attacks in mid-June has prior been linked to the RansomHub ransomware group by CISA last year – this IP has been observed dumping memory and replaying session cookies to validate them,” he said. As a result, “even if you did already patch, unless you patched extremely early, you probably need to check for signs of exploitation.”

Having tested the vulnerability using Citrix NetScaler devices in a lab setting, Beaumont discovered that administrators won’t be able to tell if any given device has been hacked or not by an attacker if they’re only using the default logging tools, which will still “come back clean unless they increased logging before.”

As a fallback, he recommends organizations at least review their firewall logs, looking for known indicators of compromise that he and other security researchers are continuing to gather and post.