If you still expose a Citrix NetScaler Gateway to the internet in 2026, treat it as a live incident risk rather than a maintenance item. CitrixBleed 2 (CVE-2025-5777) lets an unauthenticated attacker leak session tokens straight out of the appliance’s memory, replay them, and step past your multi-factor authentication without ever touching the login page. Worse, applying the patch does not evict an attacker who already harvested those tokens. The durable fix is to move remote access off the appliance entirely and broker it through Zero Trust Network Access (ZTNA).
Key takeaways
- CVE-2025-5777 is a pre-authentication memory leak (CVSS 4.0 score 9.3) added to CISA’s KEV catalog on 10 July 2025, with a 24-hour federal patch mandate.
- Each request leaks about 127 bytes of uninitialized stack memory, which can contain session cookies, SAML state, active MFA tokens, plaintext credentials, and even nsroot admin sessions.
- Patching stops future leaks but does not invalidate already-stolen sessions. You must kill active sessions and rotate secrets, including a forest-wide Active Directory password reset.
- This is a recurring pattern, not a one-off: CitrixBleed (CVE-2023-4966), CitrixBleed 2, then CVE-2026-3055 and CVE-2026-8451 all trace to the same uninitialized-memory habit in the codebase.
- Under Belgium’s NIS2 law, running a broadly-accessible, repeatedly-exploited gateway works against CyFun control PR.AC-4 and exposes the board to personal liability.
What is CitrixBleed 2 (CVE-2025-5777)?
CVE-2025-5777 is an out-of-bounds read caused by the use of an uninitialized resource inside the NetScaler Packet Parsing Engine (nsppe). The flaw sits in the authentication handler that processes HTTP POST parameters at endpoints such as /p/u/doAuthentication.do. Because the NetScaler codebase is written in C and C++, stack variables are not zeroed on allocation. Send a POST request with the parameter name login but no value and no equals sign, and the parser skips buffer initialisation while still serialising the response, reflecting raw stack memory back inside the <InitialValue> XML element.
| Attribute | Specification |
|---|---|
| Identifier | CVE-2025-5777 (“CitrixBleed 2”) |
| Weakness | Out-of-bounds read; use of uninitialized resource/variable (CWE-125, CWE-908, CWE-457) |
| CVSS | 9.3 Critical (CVSS 4.0) / 7.5 High (CVSS 3.1) |
| CISA KEV | Listed 10 July 2025; federal action due 11 July 2025 (24-hour cycle) |
| Vulnerable configs | NetScaler as Gateway (VPN vServer, ICA Proxy, CVPN, RDP Proxy) or AAA vServer |
| Vulnerable releases | 14.1 before 14.1-43.56; 13.1 before 13.1-58.32; 13.1-FIPS/NDcPP before 13.1-37.235; 12.1-FIPS before 12.1-55.328. Note: 12.1 and 13.0 are end-of-life and stay permanently vulnerable. |
How the leak bypasses MFA
Each successful request returns roughly 127 bytes of uninitialized stack memory. Because the request needs no authentication and can be repeated, an attacker automates it to harvest memory segment by segment. That memory frequently holds active session cookies (NSC_AAAC and NSC_USER), SAML StateContext structures, live MFA tokens, and plaintext credentials typed by legitimate users during concurrent logins. It sometimes contains active session tokens for the superuser account nsroot, which hands over full administrative control of the ADC instance. With a valid session cookie in hand, the attacker replays it and walks past the login portal, the Active Directory sequence, and every MFA challenge.
The exploitation timeline
CitrixBleed 2 shows how fast an uninitialized-memory flaw becomes mass exploitation. An APT actor was already using it as a zero-day before public disclosure.
| Date | Event |
|---|---|
| 17 Jun 2025 | Citrix publishes advisory CTX693420 and patches; CVE-2025-5777 added to the NVD. |
| 20 Jun 2025 | Active in-the-wild exploitation begins against public NetScaler Gateway interfaces. |
| 23 Jun 2025 | GreyNoise sensors detect targeted attempts from China-based IPs; Amazon finds an APT exploiting it as a zero-day before disclosure. |
| 4 Jul 2025 | Public proof-of-concept exploit scripts are released, lowering the barrier for opportunistic attackers. |
| 10 Jul 2025 | CISA adds CVE-2025-5777 to the KEV catalog with a 24-hour remediation mandate. |
| 11 Jul 2025 | Imperva logs roughly 12 million automated POST requests targeting the flaw. |
| 18 Jul 2025 | Over 100 organisations confirmed compromised; ransomware groups use stolen session tokens to persist via legitimate MSP tools. |
| 11 Aug 2025 | Shadowserver still counts 3,312 unpatched, exposed NetScaler appliances. |
| 23 Mar 2026 | Citrix discloses CVE-2026-3055 (“CitrixBleed 3”); CISA issues an emergency patch mandate amid immediate exploitation. |
Why patching NetScaler is not enough
A patch closes the parsing error on future requests. It does nothing about session state that leaked before you patched. If an attacker pulled active NSC_AAAC cookies before the fix landed, those cookies stay authorised in the operating system’s memory tables, and they can be replayed to bypass login, Active Directory, and MFA. Containment takes a strict sequence after the firmware upgrade:
- Hunt for hijacked sessions. Check NetScaler Gateway > Active User Sessions, or run
show sessionsandshow aaa session. A single username with concurrent sessions from different countries or mismatched user-agents signals a hijack. - Force session invalidation. The default Citrix guidance to clear ICA and PCoIP leaves RDP, AAA and load-balancing cookies intact. Run the full set:
kill icaconnection -all,kill pcoipConnection -all,kill rdp connection -all,kill aaa session -all,kill vpn -all, andclear lb persistentSessions. - Rotate every secret. Because the leaked memory can contain plaintext passwords, enforce a forest-wide Active Directory reset, reissue all SAML token-signing certificates, and rotate every administrative API secret tied to the gateway.
That is the response for one CVE. The follow-on flaws (CVE-2026-3055 and CVE-2026-8451) confirm the same class of bug recurs across different modules of the NetScaler codebase, so this containment drill repeats every cycle you stay on the appliance.
Hardening Citrix versus migrating to ZTNA
You can keep patching and hardening the gateway, or you can remove the internet-facing listener that the whole attack depends on. ZTNA connectors make outbound-only connections to a broker, so there is no public port to leak from in the first place.
| Metric | Staying on Citrix (hardening) | Migrating to ZTNA/SASE |
|---|---|---|
| Inbound attack surface | Open public TCP ports (443/8443) point straight at the packet-parsing engine | Outbound-only TLS tunnels to a broker; no public IP or inbound ports |
| Vulnerability exposure | Recurring pre-auth memory leaks and RCE | Containerised planes; memory-disclosure at the edge has nothing to read |
| Access model | User lands on a flat internal segment; lateral movement possible | 1:1 least-privilege to a single authorised app; no lateral movement |
| Client | Citrix Secure Access Client plus Workspace clients to maintain | Agentless browser access via Web Application Isolation |
| Consolidation | Separate consoles for WAF, load balancing and remote access | ZTNA, SD-WAN, SWG and WAF in one console |
Citrix’s own ZTNA route, Secure Private Access, is not a clean exit. It asks you to install Cloud Connectors, deploy VM-based connector appliances in your hypervisor, edit endpoint registry keys, and add secondary runtimes, and it still lacks native security consolidation, so you either run another agent or bolt on a third-party SASE service. That multi-hop path adds latency, troubleshooting and single points of failure. A single-platform, EU-sovereign option such as Jimber folds ZTNA, SD-WAN and secure web isolation into one cloud-managed console, which is a better fit for a lean mid-market team than stitching brokers together.
Mapping NetScaler use cases to ZTNA
A NetScaler migration is a matter of translating each proxy function to a Zero Trust equivalent.
| Legacy NetScaler use case | ZTNA replacement |
|---|---|
| SSL VPN remote access (client gets an internal IP on the LAN) | Outbound-only ZTNA microtunnels; the endpoint never receives an internal IP, and identity, MFA and device posture are checked before any path opens |
| ICA Proxy (Virtual Apps & Desktops) | Containerised, disposable workspaces; apps render in isolated containers instead of exposing the ICA stack at the perimeter |
| RDP Proxy | Clientless, browser-based secure container; the RDP session runs in an isolated remote browser and streams only pixels, air-gapping the endpoint |
| Web application / reverse proxy (public VIPs) | Web Application Isolation; HTML, CSS and JavaScript execute in an isolated container and the endpoint receives flat images, neutralising code execution and API abuse |
The migration itself is phased: map every application currently reached through NetScaler, run ZTNA connectors alongside the appliance so users validate in parallel, then cut over group by group, power down the appliance, revoke its edge certificates and close the inbound ports. Our SSL VPN deprecation timeline and VPN alternative use case cover the mechanics in more depth, and the wider enterprise VPN watchlist puts NetScaler in context.
What NetScaler exposure costs you under NIS2
Belgium transposed NIS2 through the law of 26 April 2024, with the Centre for Cybersecurity Belgium (CCB) as supervisor, and over 4,000 entities have registered. Roughly 75% of them chose the CyberFundamentals (CyFun) framework. CyFun control PR.AC-4 requires explicit, enforced least-privilege access. A gateway that drops users onto a flat network, rather than mapping them to a single application, tends to produce negative findings in a verified conformity assessment, which can mean a failed audit and exposure to fines: up to €7 million or 1.4% of global turnover for important entities, and €10 million or 2% for essential entities, plus personal liability for directors.
Insurers moved in the same direction. Underwriters now scan applicants’ public IP space, and a perimeter appliance flagged with active or historic vulnerabilities raises premiums or gets coverage denied. Some carriers write Neglected Software Exploit Endorsements that exclude claims tied to any CVSS-above-8.0 flaw left unpatched for more than three weeks, which describes CitrixBleed 2 exactly. Moving remote access to ZTNA has been linked to a 5% to 12% cut in renewal premiums, a measurable return that offsets migration cost.
Frequently asked questions
Why must we rotate Active Directory credentials if we patched NetScaler within hours?
Because CitrixBleed 2 is a pre-authentication memory leak, attackers can harvest memory repeatedly before you patch, and that memory often contains plaintext credentials from active logins. Those credentials can then be reused against Microsoft 365, other VPNs, or external databases. Patching blocks future leaks only; rotating all Active Directory passwords neutralises anything already taken.
What is the difference between the original CitrixBleed and CitrixBleed 2?
The original CitrixBleed (CVE-2023-4966) targeted the OpenID Connect discovery endpoint via a malformed Host header, which strict RFC validation at CDN and proxy layers often blocked by default. CitrixBleed 2 (CVE-2025-5777) targets legitimate application-layer POST parameters at the authentication endpoint, so it needs dedicated, request-body-aware WAF rules to catch the empty parameter.
Can F5 BIG-IP with APM replace NetScaler Gateway one-to-one?
F5 BIG-IP APM can act as an ICA proxy, but a direct one-to-one migration is complex and pulls you into multi-vendor support disputes where F5 and Citrix deflect to each other. F5 is also moving from Classic BIG-IP to F5 Next, which leaves the longevity of classic APM features uncertain, and APM often misses advanced StoreFront features. Swapping one heavy gateway for another repeats the exposure rather than removing it.
Is Kemp LoadMaster a viable NetScaler alternative for remote access?
Kemp LoadMaster is a solid Layer 4/7 load balancer and reverse proxy, but it lacks native endpoint posture checks, deep identity integration and application-level microsegmentation. It is a load balancer, not an identity-aware broker, so it cannot enforce the least-privilege access NIS2 expects or remove your external attack surface.
Can open-source proxies like HAProxy or NGINX replace NetScaler Gateway?
They are strong load balancers and reverse proxies, but they are modular components, not remote-access suites. Using them as a gateway means manually assembling and maintaining separate authentication, authorisation and WAF modules, with no unified support and a high risk of misconfiguration, and no native browser isolation or posture checks for third-party access.
How does running a legacy NetScaler Gateway affect a CyFun audit in Belgium?
CyFun control PR.AC-4 requires strict least-privilege access. A traditional gateway grants broad network-level access, letting an authenticated device see and probe the whole internal subnet. During a verification audit that broad exposure can be flagged as non-compliant, which risks audit failure, certificate rejection and NIS2 fines.
Take remote access off the appliance
If your NetScaler Gateway faces the internet, assume it is being scanned and possibly already leaking. Patch and run the full containment drill now, then map your remote-access dependencies and pilot a ZTNA cutover for one application group this quarter. Book a Jimber demo to see an agentless, EU-sovereign NetScaler replacement, or compare pricing against your next Citrix renewal.
