Full Report
A critical NetScaler ADC and Gateway vulnerability dubbed "Citrix Bleed 2" (CVE-2025-5777) is now likely exploited in attacks, according to cybersecurity firm ReliaQuest, seeing an increase in suspicious sessions on Citrix devices. [...]
Analysis Summary
Given the context provided, here is the summary of the vulnerability information:
# Vulnerability: Citrix NetScaler Session Hijacking (Citrix Bleed 2)
## CVE Details
- CVE ID: CVE-2025-5777 (Inferred from context, as the article explicitly discusses "Citrix Bleed 2 flaw" believed to be exploited now, and refers to the identifier CVE-2025-5777 in the relevant remediation section.)
- CVSS Score: Not explicitly stated in provided text.
- CWE: Not explicitly stated in provided text. This is likely related to Authentication Bypass or Session Management flaws, consistent with session hijacking.
## Affected Systems
- Products: Citrix NetScaler ADC and Gateway (Implied by context of Citrix Bleed and PCoIP/ICA connection references)
- Versions: Specific vulnerable versions are not listed, but the suggested fixed versions imply those prior to the remediation versions are vulnerable.
- Configurations: NetScaler instances handling ICA and PCoIP connections are the focus.
## Vulnerability Description
The vulnerability, referred to as "Citrix Bleed 2," allows attackers to hijack active user sessions on vulnerable Citrix NetScaler deployments. Evidence suggests active exploitation involves the attackers gaining initial unauthorized access and then performing post-exploitation activities such as domain reconnaissance (using tools like `ADExplorer64.exe` and mapping users/groups) before connecting via consumer VPN IPs to mask their origin.
## Exploitation
- Status: Exploited in the wild (Confirmed observation of active threat actor TTPs following exploitation).
- Complexity: Implied to be relatively low to achieve session hijacking once initial access is gained, though the overall attack chain complexity is medium to high based on subsequent reconnaissance.
- Attack Vector: Network access to the NetScaler endpoint is required for the initial compromise, leading to session hijacking.
## Impact
- Confidentiality: High (Enables unauthorized access to internal network resources via hijacked sessions, facilitating data theft/mapping).
- Integrity: High (Allows manipulation of compromised user sessions).
- Availability: Potential impact if post-exploitation activity leads to further disruption, but primary impact is on access control.
## Remediation
### Patches
Users must upgrade to the following minimum versions to remediate the underlying vulnerability:
* 14.1-43.56+
* 13.1-58.32+
* 13.1-FIPS/NDcPP 13.1-37.235+
### Workarounds
1. **Review and Terminate Sessions:** Before patching, review active sessions using the following commands:
* `show icaconnection`
* `NetScaler Gateway>**PCoIP>**Connections`
2. **Terminate Sessions:** After review, terminate any potentially compromised sessions:
* `kill icaconnection -all`
* `kill pcoipconnection -all`
3. **Network Limitation (If patch is delayed):** Limit external access to NetScaler using network Access Control Lists (ACLs) or firewall rules.
## Detection
- Indicators of Compromise:
* Instances of `ADExplorer64.exe` running across systems.
* Citrix sessions originating from IP addresses associated with consumer VPN providers (e.g., DataCamp IPs mentioned).
* Successful domain reconnaissance commands mapping users, groups, and permissions.
- Detection methods and tools: Monitoring NetScaler logs for suspicious connection attempts and reviewing endpoint activity for post-exploitation tool execution following successful access.
## References
- Vendor advisories: Citrix advisories regarding CVE-2025-5777 (Note: Vendor response confirmation was pending at the time of the article).
- Relevant links - defanged:
* hxxps://www.bleepingcomputer.com/news/security/new-citrixbleed-2-netscaler-flaw-let-hackers-hijack-sessions/
* hxxps://www.bleepingcomputer.com/news/security/citrix-bleed-2-flaw-now-believed-to-be-exploited-in-attacks/