OVER 1,200 CITRIX SERVERS UNPATCHED AGAINST CRITICAL AUTH BYPASS FLAW

Summary from the TLDR InfoSec newsletter

Over 1,200 Citrix NetScaler ADC and Gateway appliances remain unpatched against CVE-2025-5777 ("Citrix Bleed 2"), a critical authentication bypass vulnerability that allows attackers to hijack user sessions and bypass multi-factor authentication. ReliaQuest reports with medium confidence that the flaw is already being actively exploited, with indicators including hijacked web sessions, suspicious IP address usage, and Active Directory reconnaissance activities. Organizations must immediately patch their NetScaler appliances and terminate all active ICA and PCoIP sessions to prevent session hijacking attacks similar to those seen in previous CitrixBleed ransomware campaigns.