--- title: Addressing CitrixBleed 2: A Critical Vulnerability... description: Two critical vulnerabilities affect Citrix NetScaler ADC and Gateway products. CVE-2025-5777 (CitrixBleed 2) is an out-of-bounds read vulnerability with CVSS... canonical: https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Addressing CitrixBleed 2: A Critical Vulnerability Resolution for NetScaler Products | daily.dev og:description: Two critical vulnerabilities affect Citrix NetScaler ADC and Gateway products. CVE-2025-5777 (CitrixBleed 2) is an out-of-bounds read vulnerability with CVSS... og:url: https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po og:image: https://api.daily.dev/og/posts/i4QLIk6pO.png og:image:alt: Addressing CitrixBleed 2: A Critical Vulnerability Resolution for NetScaler Products og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Addressing CitrixBleed 2: A Critical Vulnerability Resolution for NetScaler Products **[Collections](https://daily.dev/sources/collections)** · 2 min read · 2 upvotes · 0 comments ## Summary Two critical vulnerabilities affect Citrix NetScaler ADC and Gateway products. CVE-2025-5777 (CitrixBleed 2) is an out-of-bounds read vulnerability with CVSS 9.3 that allows remote attackers to read session tokens and sensitive data from memory without authentication. CVE-2025-6543 is a memory overflow vulnerability with CVSS 9.2 that enables control flow manipulation and denial-of-service attacks. Both vulnerabilities are being actively exploited in the wild, with security researchers observing session token hijacking and reuse. Citrix has released emergency patches, and organizations must immediately upgrade to secure versions and terminate all active sessions to prevent exploitation. ## Content Citrix has updated its security advisories regarding two critical vulnerabilities affecting its NetScaler ADC and Gateway products: **CVE-2025-5777**, also known as 'CitrixBleed 2', and **CVE-2025-6543**. ### CitrixBleed 2: CVE-2025-5777 Dubbed 'CitrixBleed 2' due to similarities with the original CitrixBleed (CVE-2023-4966), CVE-2025-5777 is an out-of-bounds read vulnerability that poses a significant risk to NetScaler devices configured as Gateway or AAA virtual servers. This flaw allows remote attackers to read session tokens and sensitive data directly from memory without authentication, achieving a CVSS severity rating of 9.3. While immediate patching is recommended, experts warn of potential inevitable exploitation given the flaw's similarity to past vulnerabilities that affected major organizations. Security researchers at ReliaQuest and Arctic Wolf have observed signs of active exploitation, including session token hijacking and reuse across multiple IPs, potentially enabling persistent access even after browser sessions end. Organizations should prioritize upgrading to fixed versions and execute commands to terminate active sessions post-upgrade to mitigate risks. ### Memory Overflow: CVE-2025-6543 In addition to CitrixBleed 2, Citrix addressed a memory overflow vulnerability numbered CVE-2025-6543, scoring 9.2 on CVSS. This zero-day flaw has already been exploited in the wild and affects NetScaler ADC and Gateway products configured as Gateway or AAA virtual servers. This vulnerability can lead to control flow manipulation and denial-of-service attacks. Citrix released emergency patches to address both vulnerabilities, and immediate upgrades to secure versions are vital. Organizations are advised to not only patch the systems but also terminate all active sessions to prevent exploitation dynamics, such as session hijacking. ### Recommendations Given the severity of both vulnerabilities, timely remediation is crucial to ensure the security of affected systems. Security experts emphasize the importance of patching and active session management as key steps in defending against potential attacks. Maintaining updated systems and monitoring active exploit indicators can mitigate the risks associated with these vulnerabilities. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#authentication](https://daily.dev/tags/authentication), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Addressing CitrixBleed 2: A Critical Vulnerability Resolution for NetScaler Products","url":"https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po"},"datePublished":"2025-06-24T21:04:24.657Z","dateModified":"2025-06-27T19:09:05.837Z","description":"Two critical vulnerabilities affect Citrix NetScaler ADC and Gateway products. CVE-2025-5777 (CitrixBleed 2) is an out-of-bounds read vulnerability with CVSS...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f0035b5796056d1836ac4f9c65df6f0?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f0035b5796056d1836ac4f9c65df6f0?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/addressing-citrixbleed-2-a-critical-vulnerability-resolution-for-netscaler-products-i4qlik6po","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,authentication,vulnerability","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Addressing CitrixBleed 2: A Critical Vulnerability Resolution for NetScaler Products"}]} ```