Skip to content
All posts

· by NetProtector Security Team

CitrixBleed 2: NetScaler flaw leaks session tokens and bypasses MFA

Illustration: Memory blocks drip from the gateway, and a session token slips past the MFA protection to the attacker

Multi-factor authentication protects the login – but not the session that follows. That is exactly where CVE-2025-5777 comes in: a vulnerability in Citrix NetScaler ADC and NetScaler Gateway that has been dubbed “CitrixBleed 2” in reference to the CitrixBleed flaw of 2023. It allows attackers to read memory contents from the gateway, including session tokens of logged-in users. Citrix released updates on June 17, 2025. Since July 10, 2025, the US agency CISA has listed the vulnerability as actively exploited – and, unusually, gave US federal agencies just one day to patch.

What it is about

When a NetScaler is configured as a gateway or as an authentication server, it fails to adequately validate certain input and as a result reads beyond the end of a memory region. Security researchers at watchTowr and Horizon3 demonstrated in early July how this works: a crafted login request is enough, and the device returns a chunk of its memory in the response – roughly 127 bytes per request, according to Horizon3. By repeating the request often enough, an attacker gradually collects sensitive data. Horizon3 demonstrated that user session tokens can be stolen this way.

Key facts according to Citrix bulletin CTX693420:

  • Severity: CVSS 9.3 (CVSS 4.0, rated by Citrix).
  • Affected: NetScaler ADC and NetScaler Gateway configured as a gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Versions 12.1 and 13.0 are also vulnerable but, as end-of-life versions, no longer receive updates. Citrix-managed cloud services are not affected.
  • Fixed in: 14.1-43.56, 13.1-58.32 and 13.1-37.235 (FIPS/NDcPP) as well as later versions.
  • Prerequisite for the attack: a gateway reachable from the internet. The attacker does not need credentials.
  • Consequence: With a stolen session token, the attacker takes over an already authenticated session. The legitimate user has already completed password and MFA – the attacker no longer has to get past them.

Shortly afterwards, on June 25, a second critical vulnerability affecting the same gateway configurations followed: CVE-2025-6543 (CVSS 9.2). For this one, Citrix confirmed from the outset that it was already being exploited on unprotected devices.

Why this is urgent

The sequence of events over the past few weeks shows how quickly the situation has shifted. On June 26, Citrix stated there was no evidence of exploitation of CVE-2025-5777. On the same day, security company ReliaQuest reported that it was seeing attacks with moderate confidence: hijacked Citrix sessions used from multiple IP addresses, access from data center networks, and subsequent Active Directory reconnaissance. Since early July, the technical analyses have been public, which means that in principle anyone can exploit the flaw.

On July 10, CISA added the vulnerability to its catalog of known exploited vulnerabilities, calling it an “unacceptable risk”. Security researcher Kevin Beaumont, who coined the name “CitrixBleed 2”, believes the flaw has been exploited for about a month already.

The comparison with its predecessor is no coincidence. The original CitrixBleed vulnerability (CVE-2023-4966) worked on the same principle and was exploited on a large scale in 2023, including by ransomware groups. The pattern is familiar: anyone holding a valid session token needs neither password nor second factor. And an update alone does not terminate a session that was stolen beforehand.

What you should do now

  1. Update – to the latest version. The June releases addressing CVE-2025-5777 do not yet fix CVE-2025-6543. Only 14.1-47.46, 13.1-59.19 or 13.1-37.236 (FIPS/NDcPP) or later protect against both vulnerabilities. Systems running 12.1 or 13.0 must be migrated to a supported version.
  2. Terminate sessions. After updating, Citrix recommends kill icaconnection -all and kill pcoipConnection -all. It is advisable to terminate the remaining active VPN and AAA sessions as well. Review the sessions first: suspicious logins provide clues as to whether you were hit, and who was affected.
  3. Check logs. Look for clusters of POST requests to doAuthentication.do and for logout entries with unusual characters in the username. Sessions whose source IP changes or that originate from data center networks rather than the usual networks are also suspicious.
  4. Restrict access until the update has been applied – for example via ACL or firewall rule limiting access to known networks.
  5. If compromise is suspected, treat the affected accounts as compromised: reset credentials and investigate what happened on the internal network from the hijacked session.

What this means for protecting firewalls

CitrixBleed 2 highlights a problem that can affect any vendor: the gateway meant to let users into the network securely is itself openly reachable – and any flaw in it takes effect before all the protection mechanisms behind it. As soon as technical analyses are published, the hunt for vulnerable devices across the entire internet begins. From then on, every day until the update counts.

NetProtector steps in during this phase. It is deployed inline in front of the firewall and inspects traffic before it reaches the gateway:

  • Early warning via a shared sensor network. If a source anywhere in the NetProtector network stands out through scans or attacks, it is classified as a threat and blocked on all appliances. Your gateway does not have to be attacked itself before the source is blocked.
  • Traffic anomalies. Mass requests from individual sources or systematic probing for device types and versions are typical anomalies that NetProtector detects and reports.
  • To be honest: NetProtector does not replace the update, and it cannot undo a session that has already been stolen – that requires terminating sessions and resetting credentials. But it reduces the number of attackers who can reach your gateway at all in the time before the patch.
Global early warning system
1Somewhere in the world, an attacker starts scouting for targets.
2Sensors register the suspicious behaviour and report it to the AI platform.
3The AI classifies the source as a threat and rolls out protection to every appliance.
4The attacker is blocked everywhere – before the attack can even begin.

How the early warning system detects attackers and how NetProtector is deployed between router and firewall is described on our page How NetProtector works.

Our assessment

CitrixBleed 2 is a reminder that MFA secures the moment of login, not the entire session. A session token is worth as much as the password and second factor combined. Protecting VPN access therefore requires multiple layers: prompt updates, consistently terminating sessions after an incident, monitoring for suspicious logins – and a layer in front of the gateway that intercepts known attackers before they can try out a vulnerability.

Sources