Over 3,000 NetScaler Devices Remain Unpatched Against CitrixBleed 2 Vulnerability

As of August 2025, more than 3,300 Citrix NetScaler devices remain vulnerable to CitrixBleed 2 (CVE-2025-5777), a critical flaw allowing attackers to bypass authentication and hijack sessions. Patches were released in June 2025, but widespread exploitation continues, with ransomware groups and state-linked actors actively targeting unpatched systems¹.

Executive Summary for CISOs

The CitrixBleed 2 vulnerability affects NetScaler ADC/Gateway devices configured as VPN gateways or AAA servers. Exploitation enables session hijacking, MFA bypass, and credential theft, with confirmed ties to APT41 and LockBit 4.0 campaigns². CISA has mandated federal patching within 24 hours, but Shadowserver reports 4,500+ devices still exposed globally³.

CVSS Score: 9.2 (Critical)
Affected Versions: NetScaler ADC/Gateway 14.1 < 14.1-47.46, 13.1 < 13.1-59.19
Active Exploitation: Since June 2025, with 12M+ attack attempts logged
Key Mitigation: Patch immediately, terminate active sessions, restrict management interfaces

Technical Analysis of CitrixBleed 2

The vulnerability stems from insufficient input validation in HTTP request processing. Attackers craft requests to /vpn/ endpoints, triggering memory leaks that expose session tokens (NSC_* cookies). A simplified PoC HTTP request demonstrates the exploit mechanism⁴:

GET /vpn/../vpns/cfg/smb.conf HTTP/1.1
Host: <target>
Connection: close

Forensic analysis should focus on ns.log for anomalous access patterns and non-printable characters. Citrix’s native WAF fails to block exploits, though third-party solutions like Akamai provide mitigation⁵.

Remediation and Response

Citrix’s advisory (CTX693420) outlines patching steps, but critics note omissions in session cleanup instructions. Post-patch, administrators must manually terminate sessions and clear session files⁶:

killall -9 nshttpd && rm /var/netscaler/sessions/*

Network controls should restrict management interfaces to trusted IPs. Community tools like Kevin Beaumont’s scanner help identify exposed instances, while Wiz.io provides cloud deployment checks⁷.

Conclusion

The persistence of unpatched NetScaler devices highlights systemic challenges in enterprise patch management. With ransomware groups weaponizing CitrixBleed 2, organizations must prioritize immediate remediation and continuous monitoring for anomalous session activity.