Citrix NetScaler had another memory-disclosure bug in 2025, and the security community named it before Citrix finished describing it. CVE-2025-5777, which Kevin Beaumont tagged “CitrixBleed 2,” is a pre-authentication memory leak in NetScaler ADC and Gateway. Citrix rates it critical, CVSS base 9.3. The name is a reference to the 2023 original, CVE-2023-4966, and the reference is earned: same appliance, same class of outcome, same defender lesson that a lot of organizations had to learn twice.
This is a synthesis of the public research, not our own discovery. The detailed root-cause work belongs to watchTowr Labs and others who pulled the binary apart. What we want to do here is explain the mechanism plainly and then say why the CVSS base undersells the operational priority.
How the leak happens
The bug is a use of an uninitialized variable, CWE-457, in the authentication path. The endpoint is /p/u/doAuthentication.do. When a login request arrives with the login parameter present but malformed, sent without a value and without the equals sign, the C code that parses the request never initializes the variable that should hold that value. The server then reflects the contents of that uninitialized stack memory back to the caller, inside an XML element named <InitialValue>.
So the request is authentication-shaped but deliberately broken, and the response contains whatever happened to be sitting on the stack at that moment. Send the request again and you get a different slice of memory. Send it in a loop and you siphon stack contents piece by piece, with no credentials and no session. That is the whole primitive. It is not elegant and it does not need to be.
Why a memory leak is a session hijack
An information-disclosure bug that returns stack memory sounds bounded until you ask what lives on that stack. On a NetScaler Gateway or AAA virtual server, the answer includes session tokens. Leak a valid session token and you can replay it; the appliance treats you as the user whose token you stole. The user already cleared multi-factor authentication when their session was established, so replaying their token walks straight past it. There is no second factor to present because the session is already trusted.
That is the same shape as the 2023 CitrixBleed. It is why the “2” in the name is accurate rather than marketing. A pre-authentication reader on the box that fronts an organization’s entire remote-access perimeter is not a garden-variety info leak; it is a session-takeover oracle that an unauthenticated attacker can query at will.
Affected configurations and the fix
The exposure is on NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) or as an AAA virtual server. Per Citrix bulletin CTX693420, the affected builds are 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32; the 12.1 and 13.0 lines are end of life and remain vulnerable without a fix. The fixed builds are 14.1-43.56 and 13.1-58.32 and later.
The part defenders miss is the second half of the remediation. Patching stops the leak, but it does not invalidate the tokens that already leaked. A session token harvested before the upgrade is still valid after it. Citrix’s guidance is to terminate existing sessions once every appliance in the HA pair or cluster is on a fixed build, using the CLI: kill icaconnection -all, kill pcoipConnection -all, and clear aaa session -all. Skip that step and an attacker who already siphoned a token keeps their access through the patch. This was the exact failure mode in 2023, and it recurred in 2025.
What the CVSS base does not tell you
CVSS base 9.3 is critical, and for once the number is not the argument. The argument is context the base metric cannot carry. This is pre-authentication, on an internet-facing appliance, on the device that is the front door for remote workers and third parties. The realistic outcome is authenticated access to internal resources with multi-factor authentication bypassed. Two of those factors, “internet-facing” and “is the remote-access perimeter,” are properties of where the box sits, not of the bug, and CVSS base does not model them.
The better priority signal here is exposure plus exploitation, not the base metric. CISA added CVE-2025-5777 to the Known Exploited Vulnerabilities catalog on 2025-07-10, which is the point at which “should we prioritize this” stops being a question. Telemetry from several vendors showed large-scale probing within weeks of disclosure. If a NetScaler Gateway is reachable from the internet and running an affected build, the base metric is the least interesting thing about the situation.
Editor’s note: we keep saying the appliance perimeter is where CVSS base scoring is least useful, and CitrixBleed 2 is the cleanest example in a while. A 9.3 on a NetScaler Gateway and a 9.3 on an internal reporting server are not the same risk, and the base vector treats them as close.
For defenders
The action list is short. Upgrade every NetScaler ADC and Gateway to 14.1-43.56 or 13.1-58.32 or later. After the whole HA pair or cluster is upgraded, run the session-termination commands above; treat that as part of the patch, not an optional extra. Then review authentication logs for the window before the upgrade, looking for session reuse from unexpected addresses, because a token stolen pre-patch will not show up as a failed login. It will show up as a valid session doing things the real user did not do.
The vulnerability is a straightforward uninitialized-variable bug. The reason it mattered is placement, and the reason it hurt twice is that patching an appliance and evicting the attacker from it are two different jobs. CitrixBleed 2 earned its name on both counts.