Hackers Exploiting CitrixBleed 2 to Hijack Session Tokens and Bypass Enterprise MFA Protections
TL;DR
The security world is currently reeling from "CitrixBleed 2," a nasty piece of work tracked as CVE-2025-5777. It’s not just another theoretical bug; it’s being actively weaponized to rip through enterprise NetScaler infrastructure. At its core, this is an out-of-bounds memory read flaw. In plain English? It allows unauthenticated attackers to slurp up sensitive memory, hijack active user sessions, and waltz right past multi-factor authentication (MFA) as if it weren't even there.
This isn't a subtle exploit. It’s a sledgehammer. By firing off a single, specially crafted HTTP POST request at the /p/u/doAuthentication.do endpoint, attackers can effectively impersonate legitimate users. Because it targets the authentication handler directly, it’s become the go-to move for threat actors desperate to establish a foothold in corporate networks. Once they’re in, they’re in—often with the keys to the kingdom.
The Scale of the Breach
The fallout is already significant. Reports confirm that at least 100 organizations have been compromised via CitrixBleed 2. And here’s the kicker: despite urgent warnings and available patches, thousands of Citrix instances are still sitting out there, wide open and unpatched.
The CISA Known Exploited Vulnerabilities (KEV) catalog officially flagged this vulnerability on July 10, 2025, which should tell you everything you need to know about the level of danger here. With a CVSS score of 9.3, this is "drop everything and fix it" territory. The root cause is a classic case of insufficient input validation—specifically CWE-457—within the NetScaler ADC and Gateway authentication process.
Under the Hood: Why It Works
The vulnerability hits NetScaler ADC and Gateway devices hard, particularly those acting as VPN, ICA, CVPN, RDP, or AAA virtual servers. By manipulating the authentication handler, attackers don't need your password, and they certainly don't need your MFA token. They’ve already bypassed the gatekeeper.
If you want to get into the weeds, technical analysis of the CitrixBleed 2 exploit mechanics shows that the memory leakage provides just enough session data to clone a legitimate user's identity. It’s surgical, it’s fast, and it’s devastatingly effective.
| Attribute | Details |
|---|---|
| Vulnerability ID | CVE-2025-5777 |
| CVSS Score | 9.3 (Critical) |
| Root Cause | Insufficient Input Validation (CWE-457) |
| Attack Vector | Unauthenticated HTTP POST |
| Primary Endpoint | /p/u/doAuthentication.do |
How to Lock the Doors
If you’re running NetScaler infrastructure, you don't have the luxury of waiting. You need to verify your patch status yesterday. The official guidance from Citrix is your roadmap for remediation.
Here is what you need to do immediately:
- Patch Everything: Don't just patch the edge; install the latest vendor updates across all NetScaler ADC and Gateway instances.
- Comb Through Logs: Look for suspicious HTTP POST requests hitting that
/p/u/doAuthentication.doendpoint. If you see it, assume you’ve been compromised. - Tighten the Perimeter: If you can't patch immediately, restrict access to management and authentication interfaces to trusted IP ranges only. It’s a temporary bandage, but it’s better than leaving the door wide open.
- Watch for Ghost Sessions: Keep a sharp eye out for anomalous session activity or concurrent logins that don't match your users' typical habits.
The persistence of this threat is driven by the sheer number of unpatched boxes still connected to the internet. Because the exploit is so easy to execute and the payoff—full session hijacking—is so high, this is currently a top-tier target for cybercriminals.
The reality is that until every vulnerable instance is patched, the risk remains sky-high. If you haven't verified your environment yet, consider this your wake-up call. Treat CVE-2025-5777 as a critical threat to your internal network integrity, because that is exactly what it is. Don't wait for an alert to tell you you've been hit—take the initiative to secure your infrastructure now.
