Citrix NetScaler Under Fire: From Citrix Bleed to Citrix Bleed 2

NetScaler ADC and NetScaler Gateway (formerly Citrix ADC) are application-delivery controllers and SSL-VPN gateways deployed at the network edge, terminating remote-access sessions and holding session cookies — which makes them high-value initial-access targets. Three critical flaws drove waves of intrusions: an unauthenticated RCE (CVE-2023-3519), the infamous Citrix Bleed session-token disclosure (CVE-2023-4966), and 2025’s Citrix Bleed 2 (CVE-2025-5777). The Bleed flaws are especially dangerous because a stolen session token bypasses both passwords and MFA.

Key Exploited CVEs

A further flaw, CVE-2025-6543, was reported by watchTowr as under active exploitation alongside Citrix Bleed 2; its exact flaw type and KEV status should be confirmed against the vendor advisory and CISA KEV before relying on them. T1190 T1539

Who Exploited Them

• CVE-2023-3519: CISA advisory AA23-201A documented webshell deployment, Active Directory discovery and exfiltration against a critical-infrastructure organisation; it was not attributed to a named actor.
• CVE-2023-4966 (Citrix Bleed): CISA advisory AA23-325A tied exploitation to LockBit 3.0 affiliates (including the Boeing Distribution intrusion); officials noted both criminal and nation-state actors used it.
• CVE-2025-5777 (Citrix Bleed 2): GreyNoise reported targeted activity from China-based IPs ahead of the public proof-of-concept; attribution remains unsettled and Citrix initially disputed exploitation.

Detection & Mitigation

• Patch to fixed NetScaler builds per Citrix’s advisories.
• Critical for both Bleed flaws: after patching, terminate all active and persistent ICA and PCoIP sessions — stolen session tokens stay valid until the sessions are killed, so patching alone does not evict an attacker.
• Never expose the NetScaler management interface to the internet; segment and restrict it.
• Hunt for session reuse from new source IPs, impossible-travel on gateway logins, and malformed login POSTs indicative of memory-over-read attempts; inspect the appliance filesystem for webshells (CVE-2023-3519).